CVE-2010-4221
HIGH 10.0EPSS 91.3%
Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.
- CVSS v2.0 NVD
- 10.0 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C - EPSS
- 91.30% chance of exploitation in the next 30 days, 100th percentile
- Published
- 2010-11-09
- Updated
- 2024-08-07
Proof-of-concept exploits (6)
- M31MOTH/cve-2010-42212★ · 2017-10-22
- M41doror/cve-2010-42212★ · 2017-10-22
- Sreenivas-147/internal-penetration-testing0★ · 2025-05-23
- ankh2054/python-exploits73★ · 2021-01-26
- Esh001/MACHINE-BASIC-PENTESTING-10★ · 2026-09-06
- diegslva/cve-2010-4221-lab0★ · 2026-09-08
Metasploit modules (2)
- rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/ftp/proftp_telnet_iac.rb
- rapid7/metasploit-framework/blob/master/modules/exploits/linux/ftp/proftp_telnet_iac.rb
ExploitDB entries (3)
- https://www.exploit-db.com/exploits/16878
- https://www.exploit-db.com/exploits/16851
- https://www.exploit-db.com/exploits/15449
Security advisories
- http://secunia.com/advisories/42052
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:227
- http://www.securityfocus.com/bid/44562