CVE-2010-4221: ProFTPD TELNET IAC handling stack buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS 2.0 score of 10, very high EPSS, and public exploit references make this an urgent patch-first issue.

What it is

ProFTPD before 1.3.3c contains multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c. A remote attacker can trigger the overflow by sending a crafted TELNET IAC escape character sequence to an FTP or FTPS server. Because the flaw is reachable pre-authentication and yields code execution, it is a serious risk to any exposed ProFTPD service.

Impact

An unauthenticated remote attacker can execute arbitrary code with the privileges of the ProFTPD process, typically root on default deployments. This can lead to full host compromise, data theft, or use of the server as a foothold.

Attack surface

The flaw is reached over the network through the FTP or FTPS control connection by sending a TELNET IAC escape character; no authentication or user interaction is required per the CVSS vector AV:N/AC:L/Au:N. Any internet- or network-exposed ProFTPD instance before 1.3.3c is in scope.

Exploitation

The record is not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high (0.91303, 99.8th percentile) and multiple references are tagged Exploit, indicating public exploit material exists. Treat active exploitation as likely.

What to do

• Upgrade ProFTPD to 1.3.3c or later immediately; this is the only complete fix.
• If immediate upgrade is not possible, restrict FTP/FTPS access to trusted networks and disable or block TELNET IAC handling where feasible.
• Run the ProFTPD service as a non-privileged account and apply least privilege to limit post-exploitation impact.
• Monitor vendor and distribution advisories for backported patches if you run a packaged version.

Detection

• Inspect FTP control-channel traffic for TELNET IAC (0xFF) escape sequences, especially malformed or repeated IAC bytes, using an IDS/IPS or network sensor.
• Alert on ProFTPD process crashes, core dumps, or unexpected restarts, which can indicate exploitation attempts.
• Monitor for unexpected child processes, outbound connections, or file writes spawned by the ProFTPD service account.
• Review ProFTPD logs for anomalous pre-authentication command sequences or connection patterns from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.