{"id":"CVE-2011-5166","aliases":["EUVD-2011-5066","GHSA-gc7w-7m76-2gc2"],"status":"published","title":"Multiple stack-based buffer overflows in KnFTP 1.0.0 allow remote attackers to execute arbitrary...","description":"Multiple stack-based buffer overflows in KnFTP 1.0.0 allow remote attackers to execute arbitrary code via a long string to the (1) USER, (2) PASS, (3) REIN, (4) QUIT, (5) PORT, (6) PASV, (7) TYPE, (8) STRU, (9) MODE, (10) RETR, (11) STOR, (12) APPE, (13) ALLO, (14) REST, (15) RNFR, (16) RNTO, (17) ABOR, (18) DELE, (19) CWD, (20) LIST, (21) NLST, (22) SITE, (23) STST, (24) HELP, (25) NOOP, (26) MKD, (27) RMD, (28) PWD, (29) CDUP, (30) STOU, (31) SNMT, (32) SYST, and (33) XPWD commands.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.06481,"percentile":0.93796,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-119"],"published":"2012-09-15T17:00:00Z","modified":"2026-06-16T23:36:04Z","exploits":[{"source":"exploitdb","id":"EDB-17819","title":"KnFTP Server - Remote Buffer Overflow","type":"remote","platform":"windows","date":"2011-09-12","verified":true,"url":"https://www.exploit-db.com/exploits/17819"},{"source":"exploitdb","id":"EDB-17856","title":"KnFTP 1.0.0 Server - Multiple Buffer Overflows (PoC) (SEH)","type":"dos","platform":"windows","date":"2011-09-18","verified":true,"url":"https://www.exploit-db.com/exploits/17856"},{"source":"exploitdb","id":"EDB-17870","title":"KnFTP 1.0.0 Server - 'USER' Remote Buffer Overflow","type":"remote","platform":"windows","date":"2011-09-19","verified":true,"url":"https://www.exploit-db.com/exploits/17870"},{"source":"exploitdb","id":"EDB-18089","title":"KnFTP 1.0 - Remote Buffer Overflow (DEP Bypass) (Metasploit)","type":"remote","platform":"windows","date":"2011-11-07","url":"https://www.exploit-db.com/exploits/18089"}],"products":[{"vendor":"elif_keir","product":"knftp"}],"references":[{"url":"http://secunia.com/advisories/45907","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.exploit-db.com/exploits/17856","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2011-09/0015.html","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Exploit"]},{"url":"http://www.exploit-db.com/exploits/18089","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/69557","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.osvdb.org/75147","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.exploit-db.com/exploits/17819","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit"]},{"url":"http://www.exploit-db.com/exploits/17870","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-5166"},{"url":"https://github.com/advisories/GHSA-gc7w-7m76-2gc2"}],"sources":{"cve":[{"id":"CVE-2011-5166","description":"Multiple stack-based buffer overflows in KnFTP 1.0.0 allow remote attackers to execute arbitrary code via a long string to the (1) USER, (2) PASS, (3) REIN, (4) QUIT, (5) PORT, (6) PASV, (7) TYPE, (8) STRU, (9) MODE, (10) RETR, (11) STOR, (12) APPE, (13) ALLO, (14) REST, (15) RNFR, (16) RNTO, (17) ABOR, (18) DELE, (19) CWD, (20) LIST, (21) NLST, (22) SITE, (23) STST, (24) HELP, (25) NOOP, (26) MKD, (27) RMD, (28) PWD, (29) CDUP, (30) STOU, (31) SNMT, (32) SYST, and (33) XPWD commands.","status":"published","published":"2012-09-15T17:00:00Z","modified":"2024-08-07T00:30:46.804Z","updated_at":"2026-11-02T14:35:36.252742Z"}],"euvd":[{"id":"EUVD-2011-5066","description":"Multiple stack-based buffer overflows in KnFTP 1.0.0 allow remote attackers to execute arbitrary code via a long string to the (1) USER, (2) PASS, (3) REIN, (4) QUIT, (5) PORT, (6) PASV, (7) TYPE, (8) STRU, (9) MODE, (10) RETR, (11) STOR, (12) APPE, (13) ALLO, (14) REST, (15) RNFR, (16) RNTO, (17) ABOR, (18) DELE, (19) CWD, (20) LIST, (21) NLST, (22) SITE, (23) STST, (24) HELP, (25) NOOP, (26) MKD, (27) RMD, (28) PWD, (29) CDUP, (30) STOU, (31) SNMT, (32) SYST, and (33) XPWD commands.","status":"published","published":"2012-09-15T17:00:00Z","modified":"2024-08-07T00:30:46Z","updated_at":"2026-11-03T01:39:47.222761Z"}],"ghsa":[{"id":"GHSA-gc7w-7m76-2gc2","title":"Multiple stack-based buffer overflows in KnFTP 1.0.0 allow remote attackers to execute arbitrary...","description":"Multiple stack-based buffer overflows in KnFTP 1.0.0 allow remote attackers to execute arbitrary code via a long string to the (1) USER, (2) PASS, (3) REIN, (4) QUIT, (5) PORT, (6) PASV, (7) TYPE, (8) STRU, (9) MODE, (10) RETR, (11) STOR, (12) APPE, (13) ALLO, (14) REST, (15) RNFR, (16) RNTO, (17) ABOR, (18) DELE, (19) CWD, (20) LIST, (21) NLST, (22) SITE, (23) STST, (24) HELP, (25) NOOP, (26) MKD, (27) RMD, (28) PWD, (29) CDUP, (30) STOU, (31) SNMT, (32) SYST, and (33) XPWD commands.","status":"published","published":"2022-05-17T01:50:50Z","modified":"2023-02-03T05:05:40Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:53:46.857381Z"}],"nvd":[{"id":"CVE-2011-5166","description":"Multiple stack-based buffer overflows in KnFTP 1.0.0 allow remote attackers to execute arbitrary code via a long string to the (1) USER, (2) PASS, (3) REIN, (4) QUIT, (5) PORT, (6) PASV, (7) TYPE, (8) STRU, (9) MODE, (10) RETR, (11) STOR, (12) APPE, (13) ALLO, (14) REST, (15) RNFR, (16) RNTO, (17) ABOR, (18) DELE, (19) CWD, (20) LIST, (21) NLST, (22) SITE, (23) STST, (24) HELP, (25) NOOP, (26) MKD, (27) RMD, (28) PWD, (29) CDUP, (30) STOU, (31) SNMT, (32) SYST, and (33) XPWD commands.","status":"published","published":"2012-09-15T17:55:04.753Z","modified":"2026-06-16T23:36:04.31Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:12.639283Z"}]}}