CVE-2010-20107 FTP Synchronizer Professional <= 4.0.73.274 Stack Buffer Overflow
A stack buffer overflow in FTP Synchronizer Professional allows remote code execution via a malicious FTP server response.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2010-20107?
CVE-2010-20107 is a high-severity memory corruption vulnerability in Liuxz Software FTP Synchronizer Professional, published on 21 Aug 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A stack-based buffer overflow exists in FTP Synchronizer Professional <= v4.0.73.274. When the client connects to an FTP server and issues a LIST command—typically during sync preview or profile creation—the server’s response containing an overly long filename triggers a buffer overflow. This results in the corruption of the Structured Exception Handler (SEH), potentially allowing remote code execution.
Weakness: CWE-121
Which versions are affected by CVE-2010-20107?
How do I fix CVE-2010-20107?
No fix has been published for CVE-2010-20107 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2010-20107 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-20107 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-8xg7-6vmp-hp8c.