{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pcman-ftp-server-2.0.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pcman:ftp_server:2.0.7:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2025-4871"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PCMan FTP Server (2.0.7)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["PCMan"],"content_html":"\u003cp\u003eA remote buffer overflow vulnerability has been identified in PCMan FTP Server version 2.0.7 (CVE-2025-4871). The vulnerability allows an unauthenticated attacker to trigger memory corruption by sending a specially crafted 'REST' command to the vulnerable FTP service. Successful exploitation enables the execution of arbitrary code under the context of the FTP server process. A functional proof-of-concept exploit script is publicly available, which uses a JMP ESP instruction to redirect execution flow to attacker-supplied shellcode. This vulnerability poses a significant risk to any systems still running this legacy FTP server, particularly in environments where it may be exposed to the network.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker establishes a TCP connection to the target server on port 21.\u003c/li\u003e\n\u003cli\u003eThe attacker authenticates or uses 'anonymous' login if permitted by the server configuration.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious payload containing 2006 bytes of junk data (offset).\u003c/li\u003e\n\u003cli\u003eThe payload appends a JMP ESP memory address to overwrite the return address on the stack.\u003c/li\u003e\n\u003cli\u003eThe payload includes a NOP sled to facilitate reliable shellcode execution.\u003c/li\u003e\n\u003cli\u003eThe attacker sends the malicious payload encapsulated within a 'REST' command via the established FTP socket.\u003c/li\u003e\n\u003cli\u003eThe application fails to validate the input length of the REST command, resulting in a buffer overflow.\u003c/li\u003e\n\u003cli\u003eThe execution flow is redirected to the attacker-supplied shellcode (e.g., a reverse TCP shell), granting the attacker remote control.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full remote code execution under the privileges of the service account running the PCMan FTP Server. Given the nature of this software, it is often run with elevated or system-level privileges on legacy Windows systems, providing an attacker with persistent access, the ability to exfiltrate sensitive files, or use the compromised host as a pivot point in the network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the decommissioning of legacy FTP servers like PCMan 2.0.7, as they lack modern security mitigations. If replacement is not immediately possible, implement the following:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eBlock access to port 21 from untrusted network segments.\u003c/li\u003e\n\u003cli\u003eDeploy network-based intrusion detection to inspect FTP traffic for anomalous, overly long strings within the 'REST' command.\u003c/li\u003e\n\u003cli\u003eImplement EDR process-creation logging to detect suspicious child processes spawned by the FTP service.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-18T14:29:55Z","date_published":"2026-08-18T14:29:55Z","id":"https://feed.craftedsignal.io/briefs/2026-08-pcman-buffer-overflow/","summary":"PCMan FTP Server 2.0.7 is vulnerable to a remote buffer overflow via the REST command (CVE-2025-4871), allowing for unauthenticated remote code execution.","title":"Remote Buffer Overflow Vulnerability in PCMan FTP Server","url":"https://feed.craftedsignal.io/briefs/2026-08-pcman-buffer-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - PCMan FTP Server (2.0.7)","version":"https://jsonfeed.org/version/1.1"}