CVE-2013-4730: PCMan's FTP Server USER command buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityRemote, unauthenticated buffer overflow with public exploit code and a CVSS 2.0 score of 10, though no KEV listing confirms active exploitation.

What it is

PCMan's FTP Server 2.0.7 contains a buffer overflow in its handling of the USER command, triggered by a long string. A remote attacker can send an oversized USER argument to corrupt memory and potentially execute arbitrary code. The flaw is remotely reachable and requires no authentication, making it a serious pre-auth risk for exposed FTP services.

Impact

An attacker can execute arbitrary code with the privileges of the FTP server process, leading to full compromise of the host. The CVSS 2.0 vector shows complete confidentiality, integrity and availability impact.

Attack surface

The flaw is reached over the network via the FTP service, specifically through the USER command. No authentication is required because the USER command is processed before login, and no user interaction is needed.

Exploitation

Public exploit code exists, as indicated by Exploit-tagged references, and EPSS is high at 0.66462 (99.2nd percentile). The CVE is not listed in CISA KEV, so there is no confirmed in-the-wild exploitation record in that dataset.

What to do

• Patch or upgrade PCMan's FTP Server beyond 2.0.7 if a fixed version is available; if not, migrate to a maintained FTP server.
• Remove or restrict network exposure of the FTP service to trusted networks only.
• Enforce strict input length validation and bounds checking on the USER command if the product is retained.
• Monitor vendor and CVE feeds for a fixed release, since the record does not name one.

Detection

• Inspect FTP server logs for USER commands with abnormally long arguments or non-standard characters.
• Use network IDS/IPS signatures for oversized USER commands targeting FTP services.
• Monitor for crashes or unexpected process restarts of the FTP server that correlate with USER command traffic.
• Alert on FTP connections from untrusted sources to hosts running PCMan's FTP Server 2.0.7.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.