Skip to content
Fencer Intel
critical 10.0

CVE-2013-4730 in the critical feed json

Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USER command.

published 12y ago modified 2mo ago also EUVD-2013-4580

cvss
10.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
66.7%
EPSS 66.7% chance of exploitation in 30 days, percentile 99.2%
public exploits
12
Metasploit and Exploit-DB

Summary

Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USER command.

Is CVE-2013-4730 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

  1. First public exploit (Metasploit exploit/windows/ftp/pcman_stor)
  2. Published

Exploit prediction

66.70% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/windows/ftp/pcman_put PCMAN FTP Server Buffer Overflow - PUT Command metasploit exploit, normal rank, 2015-08-07
  • Metasploit exploit/windows/ftp/pcman_stor PCMAN FTP Server Post-Authentication STOR Command Stack Buffer Overflow metasploit exploit, normal rank, 2013-06-27
  • EDB-38013 PCMan FTP Server 2.0.7 - 'RENAME' Remote Buffer Overflow remote, 2015-08-29
  • EDB-36078 PCMan FTP Server 2.0.7 - 'MKD' Remote Buffer Overflow remote, 2015-02-14
  • EDB-31789 PCMan FTP Server 2.07 - Remote Buffer Overflow remote, 2014-02-20
  • EDB-31255 PCMan FTP Server 2.07 - 'CWD' Remote Buffer Overflow remote, 2014-01-29
  • EDB-31254 PCMan FTP Server 2.07 - 'ABOR' Remote Buffer Overflow remote, 2014-01-29
  • EDB-28328 PCMan FTP Server 2.07 - 'STOR' Remote Stack Overflow (Metasploit) remote, 2013-09-17
  • EDB-27703 PCMan FTP Server 2.07 - 'STOR' Remote Buffer Overflow remote, 2013-08-19
  • EDB-27277 PCMan FTP Server 2.07 - 'PASS' Remote Buffer Overflow remote, 2013-08-02
  • EDB-27007 PCMan FTP Server 2.0.7 - Remote (Metasploit) remote, 2013-07-22
  • EDB-26495 PCMan FTP Server 2.0 - Remote Buffer Overflow remote, 2013-06-30
  • exploit-db.com http://www.exploit-db.com/exploits/26471 referenced PoC, tagged "exploit" by a source, unverified
  • infosec42.blogspot.com http://infosec42.blogspot.com/2013/06/unauthenticated-pcman-ftp-207-buffer.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.