{"id":"CVE-2025-4180","state":"PUBLISHED","title":"PCMan FTP Server TRACE Command buffer overflow","description":"A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. Affected is an unknown function of the component TRACE Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","publishedAt":"2025-05-01T22:00:08.446Z","updatedAt":"2025-05-02T17:24:10.680Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["PCMan FTP Server"],"affected":[{"vendor":"PCMan","product":"FTP Server","versions":[{"version":"2.0.7","status":"affected"}],"modules":["TRACE Command Handler"]}],"references":["https://vuldb.com/?id.306798","https://vuldb.com/?ctiid.306798","https://vuldb.com/?submit.561035","https://fitoxs.com/exploit/exploit-25d55ad283aa400af464c76d713c07ad.txt"],"weaknesses":["CWE-120","CWE-119"],"ingestedAt":"2026-10-29T20:09:23.771Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/4xxx/CVE-2025-4180.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-4180","state":"PUBLISHED","datePublished":"2025-05-01T22:00:08.446Z","dateUpdated":"2025-05-02T17:24:10.680Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-05-01T12:44:02.692Z"},"containers":{"cna":{"title":"PCMan FTP Server TRACE Command buffer overflow","descriptions":[{"lang":"en","value":"A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. Affected is an unknown function of the component TRACE Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used."},{"lang":"de","value":"Es wurde eine kritische Schwachstelle in PCMan FTP Server 2.0.7 ausgemacht. Dabei betrifft es einen unbekannter Codeteil der Komponente TRACE Command Handler. Durch Manipulieren mit unbekannten Daten kann eine buffer overflow-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"PCMan","product":"FTP Server","versions":[{"version":"2.0.7","status":"affected"}],"modules":["TRACE Command Handler"]}],"references":[{"url":"https://vuldb.com/?id.306798","name":"VDB-306798 | PCMan FTP Server TRACE Command buffer overflow","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.306798","name":"VDB-306798 | CTI Indicators (IOB, IOC)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.561035","name":"Submit #561035 | PCMan FTP Server 2.0.7 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://fitoxs.com/exploit/exploit-25d55ad283aa400af464c76d713c07ad.txt","tags":["broken-link","exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-120","type":"CWE","lang":"en","description":"Buffer Overflow"}]},{"descriptions":[{"cweId":"CWE-119","type":"CWE","lang":"en","description":"Memory Corruption"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-05-01T22:00:08.446Z"},"timeline":[{"time":"2025-05-01T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-05-01T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-05-01T14:49:18.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Fernando Mengali (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://fitoxs.com/exploit/exploit-25d55ad283aa400af464c76d713c07ad.txt","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-02T17:24:07.454263Z","id":"CVE-2025-4180","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-02T17:24:10.680Z"}}]}}}