PT-2025-34307 · Uplusftp+1 · Uplusftp+1

Published 2025-08-21 · Updated 2025-08-22 · CVE-2010-20113

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: EasyFTP Server versions 1.7.0.11 and earlier

Description: EasyFTP Server versions 1.7.0.11 and earlier contain a stack-based buffer overflow in its HTTP interface. When processing a GET request to list.html, the server does not validate the length of the path parameter. Providing an excessively long value causes a buffer overflow on the stack, potentially corrupting control flow structures. The vulnerability is exposed through the embedded web server and does not require authentication due to default anonymous access. The product was renamed to UplusFtp in version 1.7.0.12.

Recommendations: Upgrade to EasyFTP Server version 1.7.0.12 or later.

Exploit

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2010-20113

Affected Products

Easyftp Server

Uplusftp

References · 5

• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/easyftp_list.rb · Exploit
• 🔥 https://exploit-db.com/exploits/11500 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-20113 · Security Note
• https://vulncheck.com/advisories/easyftp-server-list-html-stack-buffer-overflow · Note
• https://t.me/CVEtracker/30638 · Telegram Post