peter bassill · operator
$ cve CVE-2010-4221 JSON

CVE-2010-4221 EXPLOIT

10.0
HIGH · CVSS 2.0 · EPSS 91.3% (pctl 100)

Patch early

A public exploit exists.

Description

Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.

Scoring

CVSS10.0 (HIGH, v2.0)
VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS91.3% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-119
On CISA KEVno
Public exploityes
Published2010-11-09
Last modified2026-06-16

Affected (1)

VendorProduct
proftpdproftpd

Public exploits

SourceTitleDate
exploit-dbProFTPd 1.3.2 rc3 < 1.3.3b (Linux) - Telnet IAC Buffer Overflow (Metasploit)2011-01-09
exploit-dbProFTPd 1.3.2 rc3 < 1.3.3b (FreeBSD) - Telnet IAC Buffer Overflow (Metasploit)2010-12-02
exploit-dbProFTPd IAC 1.3.x - Remote Command Execution2010-11-07

References

→ the Explorer  ·  watch your stack  ·  NVD