CVE-2012-10030criticalCWE-306CWE-434CWE-732

CVE-2012-10030: critical vulnerability in FreeFloat FTP Server

FreeFloat FTP Server Arbitrary File Upload

Published · Updated

Follow this CVE+ Monitor FTP Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.3epss 2.4%
from disclosure to weaponsame day
Published on NVDAug 5
metasploitDec 7
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system directories. The server accepts empty credentials, defaults user access to the root of the C:\ drive, and imposes no restrictions on file type or destination path. These conditions enable attackers to upload executable payloads and .mof files to locations such as system32 and wbem\mof, where Windows Management Instrumentation (WMI) automatically processes and executes them. This results in remote code execution with SYSTEM-level privileges, without requiring user interaction.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
FreeFloat · FTP Server
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — FreeFloat FTP Server

In the same product, most dangerous first.

CVE-2025-5548MEDIUMFreeFloat FTP Server NOOP Command buffer overflowEPSS 15.9%CVE-2012-10023MEDIUMFreeFloat FTP Server USER Command Buffer OverflowEPSS 2.7%CVE-2024-0548MEDIUMFreeFloat FTP Server SIZE Command denial of serviceEPSS 1.3%CVE-2025-5330MEDIUMFreeFloat FTP Server RETR Command buffer overflowEPSS 0.8%CVE-2025-4791MEDIUMFreeFloat FTP Server HASH Command buffer overflowEPSS 0.8%CVE-2025-4790MEDIUMFreeFloat FTP Server GLOB Command buffer overflowEPSS 0.8%