CVE-2006-0441: Sami FTP Server USER command stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote, unauthenticated code execution with public exploit code and very high EPSS, though not in KEV and limited to an old, likely uncommon product.

What it is

Sami FTP Server 2.0.1 contains a stack-based buffer overflow triggered by an overly long USER command. The overflow is reported to occur when the log is viewed, allowing remote code execution. It matters because the service is network-exposed and the flaw is remotely reachable without credentials.

Impact

A remote attacker can execute arbitrary code in the context of the FTP server process, potentially gaining full control of the host. Even without code execution, the overflow can crash the service.

Attack surface

Reached over the network via the FTP USER command on the listening service; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The description notes the overflow triggers when the log is viewed, so the malicious input may be stored and detonate on log inspection.

Exploitation

Public exploit code is referenced (SecurityFocus BID 16370 and Exploit-DB 40675), and EPSS is 0.71 (99.4th percentile), indicating high likelihood of exploitation activity. The CVE is not listed in CISA KEV.

What to do

• Upgrade or replace Sami FTP Server 2.0.1 with a supported, patched release; if no fix exists, retire the product.
• Restrict FTP access to trusted networks and block port 21 from the internet where possible.
• Enforce strict input length validation on the USER command and all FTP command parsing.
• Run the FTP service under a low-privilege account with minimal filesystem and network permissions.
• Monitor vendor advisories for a fixed version and apply it as soon as available.

Detection

• Alert on unusually long USER commands or FTP command lines exceeding expected length in network or service logs.
• Monitor the FTP process for crashes, restarts, or abnormal child processes.
• Hunt for known exploit payload patterns against port 21 using IDS/IPS signatures.
• Review logs for repeated failed or malformed FTP authentication attempts from single sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.