CVE-2010-20121
EasyFTP Server versions up to 1.7.0.11 contain a stack-based buffer overflow vulnerability in the FTP command parser.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.22%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
EasyFTP Server versions up to 1.7.0.11 contain a stack-based buffer overflow vulnerability in the FTP command parser. When processing the CWD (Change Working Directory) command, the server fails to properly validate the length of the input string, allowing attackers to overwrite memory on the stack. This flaw enables remote code execution without authentication, as EasyFTP allows anonymous access by default. The vulnerability was resolved in version 1.7.0.12, after which the product was renamed “UplusFtp.”
- CVSS 4.0
- 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 3.22% probability · 88th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-121
- Affected
- easyftp server project/easyftp server
- Source
- disclosure@vulncheck.com
References
- https://paulmakowski.wordpress.com/2010/02/28/increasing-payload-size-w-return-address-overwrite/Exploit, Third Party Advisory
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/easyftp_cwd_fixret.rbExploit
- https://seclists.org/bugtraq/2010/Feb/202Exploit, Mailing List, Third Party Advisory
- https://www.exploit-db.com/exploits/11668Exploit, VDB Entry
- https://www.exploit-db.com/exploits/12312Exploit, VDB Entry
- https://www.exploit-db.com/exploits/14402Exploit, VDB Entry
- https://www.exploit-db.com/exploits/16737Exploit, VDB Entry
- https://www.vulncheck.com/advisories/easyftp-server-cwd-command-stack-buffer-overflowThird Party Advisory
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/easyftp_cwd_fixret.rbExploit
- https://seclists.org/bugtraq/2010/Feb/202Exploit, Mailing List, Third Party Advisory
- https://www.exploit-db.com/exploits/11668Exploit, VDB Entry
- https://www.exploit-db.com/exploits/12312Exploit, VDB Entry
- https://www.exploit-db.com/exploits/14402Exploit, VDB Entry
- https://www.exploit-db.com/exploits/16737Exploit, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.