Submeter #983257: Pcman's Ftp Server Project Pcman Ftp Server 2.0.7 Stack-based Buffer Overflow

A vulnerability was found in Pcman Ftp Server 2.0.7. It has been
classified as critical. Affected is an unknown function of the
component PORT Command Handler. The manipulation of the argument
leads to buffer overflow. The attack can be launched remotely. The
exploit has been disclosed to the public and may be used.

PCMan FTP Server 2.0.7 contains a stack-based buffer overflow in the
handler for the PORT command. An overly long argument overwrites the
saved return address on the stack, allowing an authenticated attacker
(anonymous login enabled by default) to achieve arbitrary code
execution. This is a distinct vulnerable code path from the overflow
covered by CVE-2013-4730 (USER command) and from the overflows already
tracked as separate CVEs for other command handlers of the same
product (PWD, STATUS, SEND, MGET, RMD, REST).

Proof-of-Concept: https://www.exploit-db.com/exploits/40714

Vendor contact: The vendor listing ("Pcman's Ftp Server Project") has
had no active maintainer or reachable contact channel since around
2013. The original project homepage (pcman.openfoundry.org) is
offline. No proprietary or private contact channel could be
identified.

Reported to VulDB: 2026-09-16

Credit: Pablo González

• Fonte: ⚠️ https://www.exploit-db.com/exploits/40714
• Utilizador: pablogonzalezpe (UID 101284)
• Submissão: 16/09/2026 07h42 (há 1 mês)
• Moderação: 12/10/2026 17h10 (26 days later)
• Estado: Aceite
• Entrada VulDB: 416953 [PCMan FTP Server até 2.0.7 PORT Command Excesso de tampão]
• Pontos: 20