CVE-2012-10035 Turbo FTP Server 1.30.823/826 PORT Command Buffer Overflow

CriticalCVSS 10.0 EPSS 1.7% Framework module

Published: 2025-08-05 23:05
Updated: 2026-06-17 02:38
Exploit status: Public exploit available

Description

Turbo FTP Server versions 1.30.823 and 1.30.826 contain a buffer overflow vulnerability in the handling of the PORT command. By sending a specially crafted payload, an unauthenticated remote attacker can overwrite memory structures and execute arbitrary code with SYSTEM privileges.

Affected products

Product	Affected versions	Fixed in
turbosoft TurboFTP Server	= 1.30.823	No fix listed
turbosoft TurboFTP Server	= 1.30.826	No fix listed

References

raw.githubusercontent.com exploit
www.exploit-db.com exploit
www.vulncheck.com third-party-advisory

CVSS v4.0

10.0 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: High
Subsequent System Integrity: High
Subsequent System Availability: High

All scores (2)

v4.0 10.0 · vulncheck
v4.0 10.0 · disclosure@vulncheck.com

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.70% (percentile 77.6)
CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

Turbo FTP Server 1.30.823 PORT Overflow Framework module · Metasploit Framework (Rapid7) · 2012-10-03