{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3apcmanftp_server2.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pcman:ftp_server:2.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2024-58299"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PCMan FTP Server (2.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","remote-code-execution","legacy-software"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003ePCMan FTP Server version 2.0 contains a critical buffer overflow vulnerability identified as CVE-2024-58299. The vulnerability is triggered when the server processes a crafted 'pwd' command containing an excessively long string. This buffer overflow permits an unauthenticated remote attacker to overwrite the stack, leading to arbitrary code execution on the target system. Proof-of-concept exploits for this vulnerability have been publicly released, including implementations in Python and Ruby, as well as an established Metasploit module. This flaw poses a significant risk to any environment still utilizing the legacy PCMan FTP Server 2.0 software, as exploitation does not require prior authentication or user interaction.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker performs network reconnaissance to identify targets running PCMan FTP Server 2.0 on port 21.\u003c/li\u003e\n\u003cli\u003eThe attacker establishes a TCP connection to the target's FTP service.\u003c/li\u003e\n\u003cli\u003eThe attacker performs initial authentication or leverages anonymous access, which is often enabled by default in this server version.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a crafted 'pwd' command containing a 2007-byte padding sequence followed by a custom return address (e.g., JMP ESP).\u003c/li\u003e\n\u003cli\u003eThe server process crashes or redirects execution flow as it attempts to process the oversized 'pwd' argument, triggering the stack overflow.\u003c/li\u003e\n\u003cli\u003eThe injected shellcode, appended to the request, is executed with the privileges of the FTP service process.\u003c/li\u003e\n\u003cli\u003eThe attacker establishes a reverse TCP meterpreter session or similar payload to achieve remote command-and-control access.\u003c/li\u003e\n\u003cli\u003eThe attacker gains unauthorized control over the host system, typically with administrative or system privileges depending on the service execution context.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full system compromise. As the FTP service often runs with high privileges, attackers can gain administrative access, exfiltrate sensitive files, or deploy additional malware. Given the publicly available PoC scripts and Metasploit modules, the barrier to entry for this exploit is low for actors targeting legacy infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the decommissioning of PCMan FTP Server 2.0. As this is legacy software, immediate migration to a modern, supported FTP or SFTP solution is the primary mitigation. Ensure network perimeter security blocks unauthorized access to port 21.\u003c/p\u003e\n","date_modified":"2026-10-19T18:22:37Z","date_published":"2026-10-19T18:22:37Z","id":"https://feed.craftedsignal.io/briefs/2026-10-pcman-ftp-overflow/","summary":"PCMan FTP Server 2.0 is vulnerable to a stack-based buffer overflow via the pwd command, allowing unauthenticated remote code execution.","title":"Remote Code Execution in PCMan FTP Server","url":"https://feed.craftedsignal.io/briefs/2026-10-pcman-ftp-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:pcman:ftp_server:2.0:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}