Back
CVE-2012-10023
FreeFloat FTP Server USER Command Buffer Overflow
Medium6.9EPSS 2.7%
- Published
- Updated
- Reserved
- Assigned by
- VulnCheck
Description
A stack-based buffer overflow vulnerability exists in FreeFloat FTP Server version 1.0.0. The server fails to properly validate input passed to the USER command, allowing remote attackers to overwrite memory and potentially execute arbitrary code. The flaw is triggered by sending an overly long username string, which overflows the buffer allocated for user authentication.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| VulnCheckCNA (assigner) | 4.0 | Medium6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
| NVDNVD · Analyzed | 4.0 | Medium6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 2.7% · top 14% of all CVEs (3 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: yes · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.
Weakness
Affected products
- affected *
References (7)
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/freefloatftp_user.rb (opens in a new tab)exploit
- https://www.exploit-db.com/exploits/23243 (opens in a new tab)exploit
- https://my.saintcorporation.com/cgi-bin/exploit_info/freefloat_ftp_server_user_cmd (opens in a new tab)third-party-advisory
- https://www.exploit-db.com/exploits/15689 (opens in a new tab)exploit
- https://web.archive.org/web/20101208040029/http://secunia.com/advisories/42465/ (opens in a new tab)technical-descriptionexploit
- https://web.archive.org/web/20101213050627/http://www.freefloat.com/sv/about-/about-.php (opens in a new tab)product
- https://www.vulncheck.com/advisories/freefloat-ftp-server-user-command-buffer-overflow (opens in a new tab)third-party-advisory
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2012-10023)Record last updated .