CVE-2005-1873

Crob FTP 3.6.1 - Remote Code Execution via Long FTP Command or Globbing Character

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2005-1873. PoCs published by Leon Juranic.

AI-analyzed exploit summary This exploit targets a stack overflow vulnerability in Crob FTP Server 3.6.1. It sends a maliciously crafted STOR command followed by a long RMD command to trigger the overflow and execute arbitrary shellcode (spawning calc.exe).

Description

Multiple buffer overflows in Crob FTP 3.6.1, and possibly earlier versions, allow remote attackers to execute arbitrary code via (1) an FTP command with a large string followed by the RMD command with a long string or (2) a globbing ("*") character followed by a long string.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Leon Juranic · cremotewindows
https://www.exploit-db.com/exploits/1028

This exploit targets a stack overflow vulnerability in Crob FTP Server 3.6.1. It sends a maliciously crafted STOR command followed by a long RMD command to trigger the overflow and execute arbitrary shellcode (spawning calc.exe).

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Crob FTP Server 3.6.1
Auth required
Prerequisites: Network access to the FTP server · Valid FTP credentials
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/15585

Scores

EPSS 0.0501
EPSS Percentile 91.1%

Details

Status published
Products (1)
crob/crob_ftp 3.6.1
Published Jun 09, 2005
Tracked Since Feb 18, 2026