CVE-2016-15060 is a high severity (CVSS 8.3) buffer overflow in the PORT command handler of PCMan FTP Server up to 2.0.7. The record says it can be attacked remotely and that the exploit is public. No fixed version is confirmed, so restrict access or replace the server.
What's affected
PCMan FTP Server up to version 2.0.7, per the record. The record says an unknown function in the PORT Command Handler component is affected, and that manipulation results in a buffer overflow.
The record is brief. It does not name a fixed version, does not describe preconditions such as anonymous access, and I could not fetch a vendor advisory to extend it. Treat that as a gap to close with the vendor rather than as a sign of low risk. The record says the exploit has been made public.
How to check if you're exposed
Find the installed version in the application or in the Windows installed programs list. Version 2.0.7 or earlier is in scope.
Find FTP servers on your networks:
nmap -sV -p 21 --open 10.0.0.0/24
Only scan networks you own or are authorised to test. Check the banners for the server name, and check your firewall for rules that expose port 21 to the internet.
Because the record does not describe preconditions, assume that anyone who can reach the FTP port may be able to reach the vulnerable handler.
What to do now
- Find every PCMan FTP Server and its version.
- Check the vendor or project site for a newer build, and apply it if one exists.
- If you cannot confirm a fix, restrict port 21 to known addresses and plan to replace the server with a maintained product.
- Review the host for unexpected processes and new accounts.
- Prefer protocols that encrypt traffic, such as SFTP, for new transfer jobs.
Why it matters
The record lists CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Classic Buffer Overflow). The PORT command tells an FTP server which address and port the client wants to use for a data connection. The server must parse that text. If it copies the text into a buffer without checking the length, long input can overwrite memory.
Parsers for command arguments are small, old and easy to get wrong, and FTP has many of them. That is why bounds checks matter on every argument, not just the obvious ones.
The record states that the exploit has been made public. It does not mark the CVE as CISA KEV, and makes no claim of exploitation in the wild.
Quick check
Is there a patched PCMan FTP Server?
I could not confirm one from the record. Check the vendor or project, and plan a replacement if there is none.
How severe is this?
The record scores it 8.3, high, and says it can be attacked remotely.
Sources
Last reviewed: 19 October 2026.
