Backdoor Vulnerability in ProFTPD FTP Server by ProFTPD Project
CVE-2010-20103

9.3CRITICAL

Key Information:

Vendor

Proftpd Project

Status
Proftpd (professional Ftp Daemon)
Vendor
CVE Published:
20 August 2025

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 83%

What is CVE-2010-20103?

The ProFTPD FTP server version 1.3.3c contains a backdoor that was inadvertently included in the source tarball distributed from November 28 to December 2, 2010. This backdoor allows unauthorized users to execute arbitrary commands on the host system by invoking a hidden FTP command. Such exploitation could lead to severe risks, as attackers can run operating system commands with root privileges, jeopardizing the integrity and confidentiality of the server and its data.

Affected Version(s)

ProFTPD (Professional FTP Daemon) 1.3.3c

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2010-20103 - Proof of Concept

CVE-2010-20103 - Proof of Concept

CVE-2010-20103 - Proof of Concept

References

https://web.archive.org/web/20111107212129/http://rsync.p...
vendor-advisorypatch
https://raw.githubusercontent.com/rapid7/metasploit-frame...
exploit
https://www.exploit-db.com/exploits/15662
exploit

EPSS Score

83% chance of being exploited in the next 30 days.

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

JSON
.