CVE-2005-1415: GlobalSCAPE Secure FTP Server buffer overflow via long FTP command

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote code execution with a high EPSS score and public exploit references, tempered only by the authentication requirement and the age of the affected version.

What it is

GlobalSCAPE Secure FTP Server 3.0.2 contains a buffer overflow that is triggered by a long FTP command. A remote authenticated user can exploit it to run arbitrary code on the server, making it a serious risk for any deployment of this version.

Impact

An attacker with valid FTP credentials gains arbitrary code execution on the server, typically at the privilege level of the FTP service. That allows full compromise of the host and any data or downstream systems it can reach.

Attack surface

Reachable over the network through the FTP service; the description states the attacker must be authenticated, so valid credentials are required. No user interaction beyond sending the crafted command is indicated.

Exploitation

No CISA KEV listing and no ransomware association; EPSS is high at roughly 0.61 (99th percentile), and references include an Exploit-tagged advisory, indicating public exploit material exists.

What to do

• Upgrade GlobalSCAPE Secure FTP Server to a version later than 3.0.2 per the vendor history/patch reference.
• If upgrade is not possible, restrict FTP access to trusted networks and disable or tightly control anonymous and shared accounts.
• Enforce strong unique credentials and least privilege for FTP accounts to limit who can reach the vulnerable command handling.
• Place the FTP service behind a filtering proxy or IPS that can drop oversized FTP commands.

Detection

• Alert on FTP command lines exceeding normal length or containing long runs of repeated bytes.
• Monitor FTP server process crashes or unexpected child process creation for signs of exploitation.
• Review FTP authentication logs for logins from unusual sources followed by abnormal command sequences.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.