CVE-2005-2373: SlimFTPd buffer overflow in LIST, DELE and RNFR commands

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw allows remote authenticated code execution and has a high EPSS score, though exploitation is limited by the need for valid FTP credentials.

What it is

SlimFTPd 3.15 and 3.16 contain a buffer overflow that is triggered by a long directory name passed to the LIST, DELE or RNFR commands. A remote authenticated FTP user can overflow the buffer and potentially execute arbitrary code on the server. The flaw is serious because it gives an authenticated user a path to full compromise of the FTP service.

Impact

An attacker who can authenticate to the FTP server can execute arbitrary code with the privileges of the SlimFTPd process. That typically means full control of the service account and any files or network access it holds.

Attack surface

The flaw is reached over the FTP protocol by sending an oversized directory name in a LIST, DELE or RNFR command. Authentication is required, and no user interaction beyond the FTP session is needed.

Exploitation

No CISA KEV entry and no public exploit tags are present in the record, but EPSS is high at roughly 0.46 (98.7th percentile), indicating elevated predicted exploitation activity. The record does not confirm that working exploits exist.

What to do

• Upgrade SlimFTPd to a version later than 3.16 if one is available; the record does not list fixed versions, so verify with the vendor.
• If no fixed version exists, restrict FTP access to trusted networks and disable or block the LIST, DELE and RNFR commands where possible.
• Enforce strong authentication and least privilege for FTP accounts so only necessary users can reach the service.
• Run SlimFTPd under a low-privilege account and isolate it from sensitive file systems and internal networks.
• Monitor vendor and vulnerability feeds for a patched release, since the referenced vendor URL is flagged as repurposed.

Detection

• Inspect FTP server logs for LIST, DELE or RNFR commands containing unusually long directory names.
• Alert on FTP sessions that issue malformed or oversized path arguments followed by process crashes or restarts.
• Monitor the SlimFTPd process for unexpected child processes, file writes or outbound connections after FTP commands.
• Baseline normal FTP command lengths and flag deviations that exceed expected directory name sizes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.