Intel

CVE-2010-20115

Der Vermillion FTP Daemon (vftpd) von Arcane Software in Versionen bis einschließlich 1.

criticalEPSS 0.9%

Description

Arcane Software’s Vermillion FTP Daemon (vftpd) versions up to and including 1.31 contains a memory corruption vulnerability triggered by a malformed FTP PORT command. The flaw arises from an out-of-bounds array access during input parsing, allowing an attacker to manipulate stack memory and potentially execute arbitrary code. Exploitation requires direct access to the FTP service and is constrained by a single execution attempt if the daemon is installed as a Windows service.

Source: cvelistv5ENISA EUVD

Metrics

XIEM Effective CVSS
9.3
Source: nvd-v4
EPSS percentile
59.2 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
critical
Priority score
85.35
Exploit maturity
no public PoC known
CVSS v4
9.3
EPSS score
0.9 %
Low — model estimates < 1% exploitation likelihood.
Published
2025-08-21 20:15 UTC
CWE
CWE-787, CWE-704

Weakness classes (CWE)

  • CWE-787Base

    Out-of-bounds Write

    The product writes data past the end, or before the beginning, of the intended buffer.

    cwe.mitre.org →

  • CWE-704Class

    Incorrect Type Conversion or Cast

    The product does not correctly convert an object, resource, or structure from one type to a different type.

    cwe.mitre.org →

References & sources