Auth bypass in Freefloat Ftp Server
CVE-2012-10030
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system directories. The server accepts empty credentials, defaults user access to the root of the C:\ drive, and imposes no restrictions on file type or destination path. These conditions enable attackers to upload executable payloads and .mof files to locations such as system32 and wbem\mof, where Windows Management Instrumentation (WMI) automatically processes and executes them. This results in remote code execution with SYSTEM-level privileges, without requiring user interaction.
Vulnerability class: Broken Authentication
EPSS: 0.015 (72.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Freefloat Freefloat_ftp_server — versions 1.0
- Freefloat Ftp Server
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@vulncheck.com (Exploit, exploit)
- disclosure@vulncheck.com (Exploit, exploit)
- disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)
- disclosure@vulncheck.com (Product, product)
- disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2012-10030?
- CVE-2012-10030 is a critical-severity vulnerability in Freefloat Ftp Server, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2025-08-05.
- How severe is CVE-2012-10030?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2012-10030 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.