{"id":"CVE-2025-4161","aliases":["EUVD-2025-14986","GHSA-h3vx-m6wj-3gqx"],"status":"published","title":"PCMan FTP Server VERBOSE Command buffer overflow","description":"A vulnerability classified as critical has been found in PCMan FTP Server up to 2.0.7. This affects an unknown part of the component VERBOSE Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00751,"percentile":0.55279,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-119","CWE-120"],"published":"2025-05-01T10:31:03Z","modified":"2026-06-17T09:32:38Z","products":[{"vendor":"pcman","product":"ftp server"},{"vendor":"pcman","product":"ftp_server"}],"references":[{"url":"https://vuldb.com/?id.306693","tags":["vdb-entry","Third Party Advisory","VDB Entry"]},{"url":"https://vuldb.com/?ctiid.306693","tags":["signature","permissions-required","Permissions Required","VDB Entry"]},{"url":"https://vuldb.com/?submit.561033","tags":["third-party-advisory","Third Party Advisory","VDB Entry"]},{"url":"https://fitoxs.com/exploit/exploit-45c48cce2e2d7fbdea1afc51c7c6ad26.txt","tags":["broken-link","exploit","Exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4161"},{"url":"https://github.com/advisories/GHSA-h3vx-m6wj-3gqx"}],"sources":{"cve":[{"id":"CVE-2025-4161","title":"PCMan FTP Server VERBOSE Command buffer overflow","description":"A vulnerability classified as critical has been found in PCMan FTP Server up to 2.0.7. This affects an unknown part of the component VERBOSE Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-05-01T10:31:03.817Z","modified":"2025-05-01T14:12:16.214Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"},{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","assessor":"cna"}],"cwes":["CWE-120","CWE-119"],"updated_at":"2026-11-02T14:32:48.512547Z"}],"euvd":[{"id":"EUVD-2025-14986","description":"A vulnerability classified as critical has been found in PCMan FTP Server up to 2.0.7. This affects an unknown part of the component VERBOSE Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-05-01T10:31:03Z","modified":"2025-05-01T14:12:16Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:51:57.509565Z"}],"ghsa":[{"id":"GHSA-h3vx-m6wj-3gqx","title":"A vulnerability classified as critical has been found in PCMan FTP Server up to 2.0.7. This...","description":"A vulnerability classified as critical has been found in PCMan FTP Server up to 2.0.7. This affects an unknown part of the component VERBOSE Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-05-01T12:31:16Z","modified":"2025-05-01T12:31:32Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:02:05.229867Z"}],"nvd":[{"id":"CVE-2025-4161","description":"A vulnerability classified as critical has been found in PCMan FTP Server up to 2.0.7. This affects an unknown part of the component VERBOSE Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-05-01T11:15:54.74Z","modified":"2026-06-17T09:32:38.017Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"secondary"}],"cwes":["CWE-119","CWE-120"],"updated_at":"2026-11-02T14:11:02.570368Z"}]}}