CVE-2010-20115 Vermillion FTP <= 1.31 Daemon PORT Command Memory Corruption
An attacker can execute arbitrary code on Vermillion FTP Daemon by sending a malformed PORT command, exploiting an out-of-bounds array access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2010-20115?
CVE-2010-20115 is a critical memory corruption vulnerability in Arcane Software Vermillion FTP Daemon, published on 21 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Arcane Software’s Vermillion FTP Daemon (vftpd) versions up to and including 1.31 contains a memory corruption vulnerability triggered by a malformed FTP PORT command. The flaw arises from an out-of-bounds array access during input parsing, allowing an attacker to manipulate stack memory and potentially execute arbitrary code. Exploitation requires direct access to the FTP service and is constrained by a single execution attempt if the daemon is installed as a Windows service.
Which versions are affected by CVE-2010-20115?
How do I fix CVE-2010-20115?
No fix has been published for CVE-2010-20115 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2010-20115 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-20115 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-qrv3-r8fp-hqxq.