PT-2026-27002 · Unknown · Free Float Ftp

Kevin Randall · Published 2026-03-22 · Updated 2026-03-22 · CVE-2019-25614

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Free Float FTP version 1.0

Description The software contains a buffer overflow in the handler for the STOR command. Remote attackers can execute arbitrary code by sending a specially crafted STOR request with an oversized payload. Attackers can authenticate using anonymous credentials to send a malicious STOR command containing 247 bytes of padding, a return address, and shellcode, triggering code execution on the FTP server. The vulnerable component is the STOR command handler.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-25614

Affected Products

Free Float Ftp

References · 4

• 🔥 https://exploit-db.com/exploits/46763 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25614 · Security Note
• https://vulncheck.com/advisories/free-float-ftp-stor-command-remote-buffer-overflow · Note
• http://freefloat.com/software/freefloatftpserver.zip · Note