Vulnerability record · CVE-2006-3726 · published 21 July 2006
CVE-2006-3726: FileCOPA FTP Server LIST command buffer overflow
IIntervations · Filecopa
FileCOPA FTP Server before the 18 July 2006 1.01 release contains a buffer overflow triggered by a long argument to the LIST command. A remote attacker who can authenticate to the FTP service can overflow the buffer and potentially execute arbitrary code on the server. The flaw matters because FTP servers are often internet-facing and this one is reachable with only valid low-privilege credentials.
Description
Buffer overflow in FileCOPA FTP Server before 1.01 released on 18th July 2006, allows remote authenticated attackers to execute arbitrary code via a long argument to the LIST command.
AV:N/AC:L/Au:S/C:P/I:P/A:P
Automated analysis
high priorityRemote code execution is possible with valid credentials, a public exploit reference exists, and EPSS is very high, though the CVSS base score is only 6.5 and no KEV listing is present.
What it is
FileCOPA FTP Server before the 18 July 2006 1.01 release contains a buffer overflow triggered by a long argument to the LIST command. A remote attacker who can authenticate to the FTP service can overflow the buffer and potentially execute arbitrary code on the server. The flaw matters because FTP servers are often internet-facing and this one is reachable with only valid low-privilege credentials.
Impact
An authenticated remote attacker can corrupt memory and execute arbitrary code in the context of the FTP server process, leading to full compromise of the host. At minimum, the overflow can crash the service, causing denial of service.
Attack surface
Reached over the network via the FTP protocol by sending an oversized argument to the LIST command. Authentication is required (CVSS vector AV:N/AC:L/Au:S), but no user interaction is needed.
Exploitation
No CISA KEV listing and no ransomware association; EPSS is high (0.637, 99th percentile), and a public exploit reference exists (appsec.ch advisory tagged Exploit), indicating exploit code is publicly available.
What to do
- Upgrade FileCOPA FTP Server to version 1.01 (18 July 2006) or later, which fixes the overflow.
- If patching is not possible, restrict FTP access to trusted networks and disable anonymous or unnecessary accounts.
- Enforce strong authentication and least privilege for FTP users to limit who can reach the vulnerable LIST command.
- Monitor vendor advisories and apply any subsequent FileCOPA security updates.
Detection
- Inspect FTP server logs for LIST commands with abnormally long arguments or malformed syntax.
- Monitor for FileCOPA process crashes or unexpected restarts that could indicate overflow attempts.
- Use network IDS/IPS signatures for oversized FTP LIST command arguments.
- Alert on repeated authentication followed by anomalous LIST activity from a single source.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-3726 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-3726), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
