CVE-2010-4221
Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD...
Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.
Exploit likelihood
What each source reports
NVD Score used
Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.
- Record
CVE-2010-4221- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.
- Record
CVE-2010-4221- Updated
- 2026-11-02
EUVDEUVD-2010-4195 No score
Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.
- Record
EUVD-2010-4195- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gf2w-q84f-pmmw No score
Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD...
Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.
- Record
GHSA-gf2w-q84f-pmmw- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.
- Record
CVE-2010-4221- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-4221 No score
Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.
- Record
DEBIAN-CVE-2010-4221- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
proftpd-dfsgDebian:12 |
before 1.3.3a-5 | 1.3.3a-5 |
proftpd-dfsgDebian:13 |
before 1.3.3a-5 | 1.3.3a-5 |
proftpd-dfsgDebian:14 |
before 1.3.3a-5 | 1.3.3a-5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | ProFTPd IAC 1.3.x - Remote Command Execution | 2010-11-07 |
| Exploit-DB | ProFTPd 1.3.2 rc3 < 1.3.3b (Linux) - Telnet IAC Buffer Overflow (Metasploit) | 2011-01-09 |
| Exploit-DB | ProFTPd 1.3.2 rc3 < 1.3.3b (FreeBSD) - Telnet IAC Buffer Overflow (Metasploit) | 2010-12-02 |
| Metasploit | ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD) | 2010-11-01 |
| Metasploit | ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (Linux) | 2010-11-01 |
| PoC in GitHub | M41doror/cve-2010-4221 | 2017-10-28 |
| PoC in GitHub | Mafiosohack/Offensive-lab-2 | 2025-12-05 |
| PoC in GitHub | diegslva/cve-2010-4221-lab | 2026-09-08 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-4221 is a high vulnerability (CVSS 10.0) in Proftpd, published November 9, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 91.3%, the 99th percentile. Fixed in proftpd-dfsg 1.3.3a-5.
References
proftpd.org/docs/NEWS-1.3.3c
lists.fedoraproject.org/pipermail/package-announce/2010-November/050687.html
zerodayinitiative.com/advisories/ZDI-10-229
secunia.com/advisories/42217
Show 10 moreShow less
vupen.com/english/advisories/2010/2941
bugs.proftpd.org/show_bug.cgi?id=3521
mandriva.com/security/advisories?name=MDVSA-2010:227
securityfocus.com/bid/44562
nvd.nist.gov/vuln/detail/CVE-2010-4221
github.com/advisories/GHSA-gf2w-q84f-pmmw
security-tracker.debian.org/tracker/CVE-2010-4221