CVE-2025-5635
BaseFortify
Publication date: 2025-06-05
Last updated on: 2025-06-17
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pcman_ftp_server_project | pcman_ftp_server | 2.0.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-5635 is a critical buffer overflow vulnerability in PCMan FTP Server version 2.0.7, specifically in the PLS Command Handler. The vulnerability occurs because the server copies an input buffer to an output buffer without checking if the input size fits, leading to a buffer overflow. This flaw can be exploited remotely without authentication by sending an excessively long input to the PLS FTP command, causing the server to crash or allowing an attacker to execute arbitrary code remotely. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by compromising the confidentiality, integrity, and availability of the affected system. An attacker can remotely exploit the buffer overflow to crash the server or gain remote code execution with the privileges of the FTP server process. This can lead to unauthorized access, data leakage, system compromise, or denial of service. The exploit is publicly available and considered easy to execute, increasing the risk of attacks. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending an excessively long input to the "PLS" FTP command on a PCMan FTP Server 2.0.7 instance and observing if the server crashes or behaves unexpectedly, indicating a buffer overflow. A practical detection method involves using Metasploit Framework commands such as generating a cyclic pattern with `msf-pattern_create -l 3000` and sending it to the server, then analyzing the crash to identify overwritten EIP values with `msf-pattern_offset -q <EIP_value>`. Additionally, debugging tools like Immunity Debugger with the Mona plugin (`!mona jmp -r esp -n`) can be used to analyze the exploitability. A direct test can be performed by sending a crafted "PLS" command with a large payload to the FTP server and monitoring for crashes or abnormal behavior. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the affected PCMan FTP Server 2.0.7 with an alternative FTP server software, as no known countermeasures or patches are currently available. Since the vulnerability is remotely exploitable without authentication and a public exploit exists, it is critical to discontinue use of the vulnerable version or restrict network access to the FTP server to trusted hosts only. Monitoring network traffic for suspicious "PLS" command usage and applying network-level protections such as firewall rules to block or limit access to the FTP server can also help reduce risk until a secure version or patch is available. [1]