CVE-2010-20103

A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host.

CVSS v4.0

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

5.05% chance of exploitation in the next 30 days, 92th percentile

Nuclei

critical

Published

2025-08-20

Updated

2026-07-15

Proof-of-concept exploits (2)

• https://www.exploit-db.com/exploits/15662
• https://www.exploit-db.com/exploits/16921

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/javascript/cves/2010/CVE-2010-20103.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/unix/ftp/proftpd_133c_backdoor.rb

References

• CVE Record
• NVD entry

Related

• CVE-2010-2008
• CVE-2010-20107
• CVE-2010-2006
• CVE-2010-20108
• CVE-2010-20059
• CVE-2010-20109