CVE-2019-25614
Published: 22 March 2026
Description
Free Float FTP 1.0 contains a buffer overflow vulnerability in the STOR command handler that allows remote attackers to execute arbitrary code by sending a crafted STOR request with an oversized payload. Attackers can authenticate with anonymous credentials and send…
more
a malicious STOR command containing 247 bytes of padding followed by a return address and shellcode to trigger code execution on the FTP server.
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates identification, reporting, and correction of the buffer overflow flaw in the STOR command handler to eliminate the vulnerability.
Requires validation of STOR command payloads to reject oversized inputs that trigger the buffer overflow.
Enforces memory protections such as ASLR and DEP to prevent arbitrary code execution from successful buffer overflows.
Security SummaryAI
Free Float FTP version 1.0 contains a buffer overflow vulnerability (CWE-787) in its STOR command handler. This flaw allows remote attackers to execute arbitrary code by sending a specially crafted STOR request with an oversized payload. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its critical severity due to high confidentiality, integrity, and availability impacts.
Remote attackers can exploit this vulnerability over the network without authentication privileges beyond anonymous FTP credentials. By crafting a malicious STOR command—consisting of 247 bytes of padding followed by a return address and shellcode—they can trigger the buffer overflow, leading to arbitrary code execution on the FTP server. No user interaction is required, making it highly exploitable in default configurations.
Advisories and references, including the Vulncheck advisory on the Free Float FTP STOR command remote buffer overflow and an Exploit-DB entry (46763) with a public proof-of-concept, provide technical details but do not specify official patches. The original software download is available from the vendor site.
A public exploit is documented on Exploit-DB, indicating potential for real-world attacks against unpatched instances of this legacy FTP server.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in FTP server's STOR command enables remote unauthenticated arbitrary code execution on a public-facing application.