Buffer overflow in Arcane Software Vermillion Ftp Daemon
CVE-2010-20115
Arcane Software’s Vermillion FTP Daemon (vftpd) versions up to and including 1.31 contains a memory corruption vulnerability triggered by a malformed FTP PORT command. The flaw arises from an out-of-bounds array access during input parsing, allowing an attacker to manipulate stack memory and potentially execute arbitrary code. Exploitation requires direct access to the FTP service and is constrained by a single execution attempt if the daemon is installed as a Windows service.
EPSS: 0.009 (56.7th percentile) — read the EPSS interpretation.
Affected products
- Arcane Software Vermillion Ftp Daemon — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (third-party-advisory)
- disclosure@vulncheck.com (third-party-advisory)
- disclosure@vulncheck.com (technical-description, exploit)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2010-20115?
- CVE-2010-20115 is a vulnerability in Arcane Software Vermillion Ftp Daemon, classified under Incorrect Type Conversion or Cast. Published 2025-08-21.
- Is CVE-2010-20115 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.