CVE-2012-10023: medium-severity vulnerability in FreeFloat FTP Server
FreeFloat FTP Server USER Command Buffer Overflow
Published · Updated
28Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 6.9epss 2.5%
from disclosure to weapon0 days
Published on NVDAug 5
metasploitJun 12
exploitation probability
2.5%top 16% of all CVEs
observed exploitation
nono source reports it
A stack-based buffer overflow vulnerability exists in FreeFloat FTP Server version 1.0.0. The server fails to properly validate input passed to the USER command, allowing remote attackers to overwrite memory and potentially execute arbitrary code. The flaw is triggered by sending an overly long username string, which overflows the buffer allocated for user authentication.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
FreeFloat · FTP ServerRelated CVEs — FreeFloat FTP Server
In the same product, most dangerous first.
CVE-2025-5548MEDIUMFreeFloat FTP Server NOOP Command buffer overflowEPSS 15.0%CVE-2012-10030CRITICALFreeFloat FTP Server Arbitrary File UploadEPSS 2.2%CVE-2024-0548MEDIUMFreeFloat FTP Server SIZE Command denial of serviceEPSS 1.3%CVE-2025-4791MEDIUMFreeFloat FTP Server HASH Command buffer overflowEPSS 0.8%CVE-2025-4790MEDIUMFreeFloat FTP Server GLOB Command buffer overflowEPSS 0.8%CVE-2025-4789MEDIUMFreeFloat FTP Server LCD Command buffer overflowEPSS 0.8%
References
https://my.saintcorporation.com/cgi-bin/exploit_info/freefloat_ftp_server_user_cmdhttps://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/freefloatftp_user.rbhttps://web.archive.org/web/20101208040029/http://secunia.com/advisories/42465/https://web.archive.org/web/20101213050627/http://www.freefloat.com/sv/about-/about-.phphttps://www.exploit-db.com/exploits/15689https://www.exploit-db.com/exploits/23243https://www.vulncheck.com/advisories/freefloat-ftp-server-user-command-buffer-overflow