FreeFloat FTP Server Arbitrary File Upload

published 2025-08-05 15 mo ago modified 2026-06-16 4 mo ago also EUVD-2012-6578

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.6%; EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits: 1; Metasploit

FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system directories. The server accepts empty credentials, defaults user access to the root of the C:\ drive, and imposes no restrictions on file type or destination path. These conditions enable attackers to upload executable payloads and .mof files to locations such as system32 and wbem\mof, where Windows Management Instrumentation (WMI) automatically processes and executes them. This results in remote code execution with SYSTEM-level privileges, without requiring user interaction.

Timeline

2012-12-07 First public exploit (Metasploit exploit/windows/ftp/freefloatftp_wbem)
2025-08-05 Published

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: total
Assessed: 15 mo ago (2025-08-06)

Exploit prediction

2.59% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/windows/ftp/freefloatftp_wbem FreeFloat FTP Server Arbitrary File Upload metasploit exploit, excellent rank, 2012-12-07
raw.githubusercontent.com https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/freefloatftp_wbem.rb referenced PoC, tagged "exploit" by a source, unverified
exploit-db.com https://www.exploit-db.com/exploits/23226 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

FreeFloat FTP Server

Classification

Weakness

CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-306 Missing Authentication for Critical Functionality
CWE-732 Incorrect Permission Assignment for Critical Resource

References

raw.githubusercontent.com /rapid7/metasploit-framework/master/modules/exploits/windows/ftp/freefloatftp_wbem.rb
exploit
exploit-db.com /exploits/23226
exploit
fortiguard.com /encyclopedia/ips/34209/freefloat-ftp-server-arbitrary-file-upload
third-party-advisory
archive.org /details/tucows_367516_Freefloat_FTP_Server
product
vulncheck.com /advisories/freefloat-ftp-server-arbitrary-file-upload
third-party-advisory

Sources

CVE List CVE-2012-10030
NVD CVE-2012-10030

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary