CVE-2005-1323: NetFtpd in NetTerm buffer overflow via long USER command

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote buffer overflow with public exploit references and very high EPSS, though the product is legacy and no KEV listing exists.

What it is

NetFtpd, the FTP server component shipped with NetTerm 5.1.1 and earlier, contains a buffer overflow that is triggered by an overly long USER command. Because the flaw is reachable over the network before authentication, it exposes any listening NetFtpd instance to remote code execution attempts. The record is old and thin: no affected-version detail beyond 5.1.1 and earlier, and no vendor fix specifics are given.

Impact

A remote attacker can overflow the buffer and potentially execute arbitrary code with the privileges of the NetFtpd service. Even without confirmed code execution, the same input can crash the service, causing denial of service.

Attack surface

Reached over the network via the FTP protocol by sending a long USER command to the NetFtpd listener; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. Any host exposing NetFtpd is directly reachable.

Exploitation

Not listed in CISA KEV, but EPSS is 0.63071 (99th percentile) and a SecurityFocus reference is tagged Exploit, indicating public exploit material exists and exploitation is plausible. No ransomware association is documented.

What to do

• Patch or upgrade NetTerm/NetFtpd beyond 5.1.1 per the vendor's what's-new page; if no fix is available, retire or replace the component.
• Stop exposing NetFtpd to untrusted networks; restrict FTP access to trusted hosts via firewall or ACL.
• Disable the NetFtpd service entirely if it is not required.
• Where the service must remain, place it behind a filtering proxy or IDS/IPS that rejects oversized USER commands.
• Monitor vendor and OSVDB/Secunia advisories for any updated fixed version.

Detection

• Inspect FTP server logs for USER commands with abnormally long arguments or non-standard characters.
• Alert on NetFtpd process crashes or restarts correlated with inbound FTP connections.
• Use network IDS signatures for oversized FTP USER commands targeting port 21.
• Baseline normal USER command lengths and flag outliers from external sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.