CVE-2010-20103
ProFTPD 1.3.3c Backdoor Command Execution
- State
- Published
- Severity
- 9.3 Critical
- Published
- Aug 20, 2025
- Updated
- Jul 15, 2026
- Reserved
- Aug 19, 2025
Description
A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-912 Hidden Functionality
Affected Products
| Product | Versions |
|---|---|
ProFTPD (Professional FTP Daemon)ProFTPD Project |
|
References
- https://web.archive.org/web/20111107212129/http://rsync.proftpd.org/vendor-advisorypatch
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/ftp/proftpd_133c_backdoor.rbexploit
- https://www.exploit-db.com/exploits/15662exploit
- https://www.exploit-db.com/exploits/16921exploit
- https://advisories.checkpoint.com/defense/advisories/public/2011/cpai-2010-151.html/third-party-advisory
- https://github.com/proftpd/proftpdproduct
- http://www.proftpd.org/product
- https://www.vulncheck.com/advisories/proftpd-backdoor-command-executionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.