CVE-2010-20121 is a critical (CVSS 9.8) stack-based buffer overflow in the FTP command parser of EasyFTP Server up to 1.7.0.11. Input to the CWD command is not length checked, so a remote user can overwrite stack memory without logging in. The record says 1.7.0.12 resolved it, and the product became UplusFtp.
What's affected
EasyFTP Server versions up to 1.7.0.11. The fix is version 1.7.0.12, after which the product was renamed UplusFtp, per the record.
This is the second EasyFTP overflow in this series. The earlier one, CVE-2010-20113, is in the embedded web interface. This one is in the FTP command parser itself, so any host that exposes the FTP port is in scope, whether or not the web interface is on. The record says anonymous access is the default, which means no credentials are required.
How to check if you're exposed
Confirm the installed version first. On Windows, check the executable's file properties and the installed programs list.
Next, find out whether the FTP port is reachable and whether anonymous login is accepted. From a trusted host on your own network:
nmap -sV -p 21 <server-address>
Review the server's own user settings for an anonymous account. If anonymous access is on and the version is 1.7.0.11 or earlier, assume the host is exposed to anyone who can reach port 21.
Also check where port 21 is forwarded from. A forgotten router rule is a common reason an internal file server ends up on the internet.
What to do now
- List every EasyFTP or UplusFtp install and note its version.
- Upgrade anything at 1.7.0.11 or earlier to 1.7.0.12 or later.
- Disable anonymous access if it is not needed, and require authenticated users.
- Restrict port 21 to the addresses that need it. Do not expose a legacy FTP server directly to the internet.
- Plan a move off the product. Plain FTP sends credentials and data unencrypted, and the older versions of this server are no longer a good base.
Why it matters
The weakness is CWE-121 (Stack-based Buffer Overflow) in a command parser. FTP commands such as CWD take a string argument. If the server copies that string into a small stack buffer without checking its length, an attacker controls memory next to the buffer. On a server that runs with broad privileges, that can mean full control of the machine.
What makes this case worth a short note is the combination of two defaults: an input parser with no bounds check, and anonymous access on. Either alone is a problem. Together they remove any login barrier. The record does not flag the CVE as CISA KEV, and it makes no statement about exploitation in the wild, though public exploit material is listed among its references.
Quick check
Is this the same bug as CVE-2010-20113?
No. That one is in the embedded web interface (list.html). This one is in the FTP CWD command handler. Both are fixed in 1.7.0.12 according to the records.
Do I need to be logged in?
The record says anonymous access is on by default, so no credentials are needed on a default install.
Sources
Last reviewed: 19 October 2026.
