PT-2025-31982 · Unknown · Freefloat Ftp Server
Published
2013-01-03
·
Updated
2025-08-05
·
CVE-2012-10030
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
FreeFloat FTP Server (affected versions not specified)
Description
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system directories. The server accepts empty credentials, defaults user access to the root of the C: drive, and imposes no restrictions on file type or destination path. These conditions enable attackers to upload executable payloads and .mof files to locations such as
system32 and wbemmof, where Windows Management Instrumentation (WMI) automatically processes and executes them. This results in remote code execution with SYSTEM-level privileges, without requiring user interaction. Windows Management Instrumentation (WMI) is a management infrastructure for Windows that provides a standardized way to access and manage system information and perform administrative tasks.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
Missing Authentication
Unrestricted File Upload
Incorrect Permission
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Freefloat Ftp Server