CVE-2011-2523: vsftpd 2.3.4 tainted build ships remote root backdoor shell

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote root compromise with a near-maximum EPSS score and public exploit code.

What it is

The vsftpd 2.3.4 source downloaded between 20110630 and 20110703 was modified to include a backdoor that opens a shell on port 6200/tcp. Any host running that specific tainted build is remotely commandeable, and the flaw is classified as OS command injection (CWE-78).

Impact

An unauthenticated remote attacker gains a root-level shell on the FTP server, allowing full control of the host, data theft, and use as a pivot point.

Attack surface

Reachable over the network via the FTP service; the CVSS vector shows no privileges or user interaction required. The backdoor shell is then exposed on TCP port 6200.

Exploitation

Not listed in CISA KEV, but EPSS is 0.96184 (99.876th percentile) and public exploit references exist, indicating active and reliable exploitation.

What to do

• Replace the tainted vsftpd 2.3.4 build with a clean, current vsftpd release from a trusted source and verify package checksums.
• If replacement is not immediate, block inbound TCP 6200 and restrict FTP access to trusted networks.
• Audit hosts for vsftpd 2.3.4 binaries built between 20110630 and 20110703 and rebuild or reinstall from verified media.
• Treat any host that ran the tainted build as compromised and perform incident response, including credential rotation.

Detection

• Alert on inbound or outbound TCP connections to port 6200.
• Monitor FTP authentication logs for the backdoor trigger pattern (username ending in :) followed by shell activity.
• Hunt for unexpected shell processes spawned by vsftpd or listening sockets on 6200.
• Check installed vsftpd version and build date against the tainted window.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.