216.73.216.169

CVE-2010-20121

· Published 21/08/2025 20:15 · Modified 21/08/2025 20:15

Labels: CVE-2010-20121 2025-08-21CVE-2010-20121CWE-121[email protected]

Essential information

Published
21/08/2025 20:15
Modified
21/08/2025 20:15
Author
—
Creator
—
CVSS
9.3 CRITICAL (v3) 9.3 CRITICAL (v4.0)
CISA KEV
No
CWE
—
CVSS vector
—

CVSS metrics

Description

EasyFTP Server versions up to 1.7.0.11 contain a stack-based buffer overflow vulnerability in the FTP command parser. When processing the CWD (Change Working Directory) command, the server fails to properly validate the length of the input string, allowing attackers to overwrite memory on the stack. This flaw enables remote code execution without authentication, as EasyFTP allows anonymous access by default. The vulnerability was resolved in version 1.7.0.12, after which the product was renamed “UplusFtp.”

NVD status

Status
Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
easyftp / easyftp cpe:2.3:a:easyftp:easyftp:*:<1.7.0.12>*:*:*:*:*:*
uplusftp / uplusftp cpe:2.3:a:uplusftp:uplusftp:*:*:*:*:*:*:*

References