CVE-2005-3589: FileZilla Server Terminal buffer overflow via long USER command

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw is remotely exploitable without authentication and causes full availability loss, with high EPSS and public proof-of-concept references, though it is an old product and not in KEV.

What it is

FileZilla Server Terminal 0.9.4d contains a buffer overflow that can be triggered by an overly long USER FTP command. A remote attacker can crash the terminal process, causing a denial of service. The record is old and thin on technical detail, but the flaw is remotely reachable without authentication.

Impact

An attacker gains the ability to crash the FileZilla Server Terminal process, disrupting FTP service availability. There is no stated impact on confidentiality or integrity, only availability.

Attack surface

The flaw is reached over the network through the FTP USER command, as reflected by the AV:N vector. No authentication or user interaction is required because the command is processed before login completes.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at roughly 0.53 (99th percentile), and public references include proof-of-concept write-ups, indicating exploit code is likely available. No ransomware usage is documented.

What to do

• Apply the vendor patch referenced in the SourceForge release notes for FileZilla Server Terminal.
• If patching is not possible, restrict FTP access to trusted networks and disable or replace the affected terminal component.
• Enforce strict length validation on FTP command input at the perimeter where feasible.
• Monitor for and rate-limit repeated malformed or oversized USER commands from single sources.

Detection

• Alert on FTP USER commands exceeding normal username length limits.
• Monitor FileZilla Server Terminal process crashes or unexpected restarts.
• Correlate repeated connection attempts followed by service termination from the same source IP.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.