CVE-2025-5548
Published: 04 June 2025
Summary
CVE-2025-5548 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Freefloat Freefloat Ftp Server. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A critical buffer overflow vulnerability was discovered in FreeFloat FTP Server 1.0 within the NOOP Command Handler component. The flaw, tracked as CVE-2025-5548 and assigned CWE-119 and CWE-120, arises from improper handling of crafted input to the affected command, enabling memory corruption. It received a CVSS 4.0 score of 6.9 and can be triggered remotely without authentication or user interaction.
An attacker able to reach the FTP service can send a malicious NOOP command to trigger the overflow. Successful exploitation may allow limited impacts on confidentiality, integrity, and availability of the server process, though the precise code execution or crash outcomes depend on memory layout at the time of attack. A public exploit has already been disclosed.
EPSS for the CVE rose from a low baseline to a peak of 0.0324 (current value 0.0184), indicating growing exploitation interest after disclosure. The referenced advisories and exploit materials provide no vendor patch or mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16815
Vulnerability details
A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component NOOP Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The…
more
exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in FreeFloat FTP Server's NOOP command handler enables remote unauthenticated exploitation of a public-facing application for remote code execution.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.
Ongoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.
Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.
Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.