Skip to content
Fencer Intel
critical 9.8

CVE-2010-20103 in the critical feed json

ProFTPD 1.3.3c Backdoor Command Execution

published 2025-08-20 14 mo ago modified 2026-07-15 3 mo ago also EUVD-2010-5301

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
13.8%
EPSS 13.8% chance of exploitation in 30 days, percentile 96%
public exploits
1
Metasploit, plus a Nuclei check

Summary

A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host.

Patch / fix

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2010-20103 updated cvss 10.0

proftpd: ProFTPD 1.3.3c Backdoor Command Execution

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit exploit/unix/ftp/proftpd_133c_backdoor)
  2. Published

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
14 mo ago

Exploit prediction

13.76% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/unix/ftp/proftpd_133c_backdoor ProFTPD 1.3.3c Backdoor Command Execution metasploit exploit, excellent rank, 2010-12-02
  • Nuclei template ProFTPd-1.3.3c - Backdoor Command Execution nuclei detection template
  • raw.githubusercontent.com https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/ftp/proftpd_133c_backdoor.rb referenced PoC, tagged "exploit" by a source, unverified
  • exploit-db.com https://www.exploit-db.com/exploits/15662 referenced PoC, tagged "exploit" by a source, unverified
  • exploit-db.com https://www.exploit-db.com/exploits/16921 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • ProFTPD Project ProFTPD (Professional FTP Daemon)

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.