CVE-2017-15222: Ayukov NFTPD buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityUnauthenticated remote code execution with public exploit code and very high EPSS probability, though not in KEV.

What it is

Ayukov NFTPD 2.0 and earlier contains a classic buffer overflow (CWE-120) that remote attackers can trigger to execute arbitrary code. The flaw is network-reachable with no authentication or user interaction, and public exploit code exists, making it a serious risk for any exposed FTP service.

Impact

An unauthenticated remote attacker can execute arbitrary code on the FTP server, gaining full control of the host process and potentially the underlying system.

Attack surface

Reachable over the network via the FTP service (AV:N, PR:N, UI:N); no credentials or user interaction are required to trigger the overflow.

Exploitation

Not listed in CISA KEV, but EPSS is 0.603 (99th percentile) and multiple references are tagged Exploit, including Exploit-DB entries, indicating public exploit code is available.

What to do

• Patch or upgrade NFTPD beyond 2.0; if no fixed release exists, migrate to a maintained FTP server.
• Remove internet exposure of NFTPD and restrict access to trusted management networks.
• Enforce authentication and network ACLs so only known clients can reach the FTP port.
• Monitor vendor and Exploit-DB references for updated fixes and apply them promptly.

Detection

• Inspect FTP service logs for malformed or oversized commands preceding crashes or restarts.
• Alert on unexpected process crashes or restarts of the NFTPD service.
• Monitor for post-exploitation behavior such as new listening ports, spawned shells, or outbound connections from the FTP host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.