CVE-2016-15060

8.3High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.3High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-119, CWE-120

Impact

Remote, unauthenticated attackers can trigger a buffer overflow and potentially execute code or crash the service. All they need is network access to the FTP port.

Root cause

The PORT command handler does not properly bound input, causing a classic buffer overflow.

Affected systems

PCMan FTP Server up to 2.0.7

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Fix & remediation

No official patch is documented; decommission PCMan FTP Server immediately and migrate to a maintained FTP daemon, or block incoming traffic on FTP port 21 at the firewall.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A vulnerability was found in PCMan FTP Server up to 2.0.7. This affects an unknown function of the component PORT Command Handler. The manipulation results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.

References

Source: nvd.nist.gov/vuln/detail/CVE-2016-15060