{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ftp-server--2.0.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pcman:ftp_server:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.3,"id":"CVE-2016-15060"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FTP Server (\u003c= 2.0.7)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["PCMan"],"content_html":"\u003cp\u003ePCMan FTP Server versions up to and including 2.0.7 are vulnerable to a buffer overflow vulnerability within the PORT command handler. This flaw allows a remote, unauthenticated attacker to send a specially crafted request that triggers memory corruption. The vulnerability stems from improper bounds checking when processing the PORT command, which facilitates the execution of arbitrary code or results in a service crash. With public exploit material available, defenders must prioritize patching or isolating instances of this legacy FTP server, as it lacks modern memory protections and presents a significant remote code execution risk.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability leads to complete compromise of the hosting server via arbitrary code execution or results in persistent denial of service. The vulnerability affects all deployments of PCMan FTP Server version 2.0.7 and earlier, which are commonly found in legacy environments or misconfigured test setups.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade PCMan FTP Server to a supported, secure alternative, as version 2.0.7 is end-of-life and contains known unpatched vulnerabilities.\u003c/li\u003e\n\u003cli\u003eImplement network segmentation to restrict access to FTP services to authorized IP ranges only.\u003c/li\u003e\n\u003cli\u003eMonitor server logs for unexpected process crashes or anomalous traffic patterns directed at the FTP port (default TCP 21) that deviate from standard file transfer sequences.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T18:33:49Z","date_published":"2026-10-14T18:33:49Z","id":"https://feed.craftedsignal.io/briefs/2026-10-pcman-ftp-overflow/","summary":"PCMan FTP Server versions through 2.0.7 contain a buffer overflow vulnerability in the PORT command handler that allows remote attackers to execute arbitrary code or trigger a denial of service.","title":"Buffer Overflow Vulnerability in PCMan FTP Server","url":"https://feed.craftedsignal.io/briefs/2026-10-pcman-ftp-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - FTP Server (\u003c= 2.0.7)","version":"https://jsonfeed.org/version/1.1"}