Multiple stack-based buffer overflows in KnFTP 1.0.0 allow remote attackers to execute arbitrary code via a long string to the (1) USER, (2…

1. 2011-09-12 First public exploit (EDB-17819)
2. 2012-09-15 Published

6.48% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-09).

• EDB-18089 KnFTP 1.0 - Remote Buffer Overflow (DEP Bypass) (Metasploit) remote, 2011-11-07
• EDB-17870 KnFTP 1.0.0 Server - 'USER' Remote Buffer Overflow remote, 2011-09-19
• EDB-17856 KnFTP 1.0.0 Server - Multiple Buffer Overflows (PoC) (SEH) dos, 2011-09-18
• EDB-17819 KnFTP Server - Remote Buffer Overflow remote, 2011-09-12
• archives.neohapsis.com http://archives.neohapsis.com/archives/bugtraq/2011-09/0015.html referenced PoC, tagged "exploit" by a source, unverified

Weakness

• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

• exploit-db.com /exploits/17856

  exploit

• exploit-db.com /exploits/18089

  exploit

• exploit-db.com /exploits/17819

  exploit

• exploit-db.com /exploits/17870

  exploit

• archives.neohapsis.com /archives/bugtraq/2011-09/0015.html

  mailing-list, exploit

• secunia.com /advisories/45907

  third-party-advisory, vendor-advisory

• exchange.xforce.ibmcloud.com /vulnerabilities/69557

  vdb-entry

• osvdb.org /75147

  vdb-entry

• CVE List CVE-2011-5166
• NVD CVE-2011-5166

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.