CVE-2011-10005 is a medium severity (CVSS 6.3) buffer overflow in the MKD command handler of EasyFTP Server 1.7.0.2, a Windows FTP server. An exploit is public. I could not confirm a fixed version, so the safe move is to retire it or keep it off any untrusted network.
What's affected
The NVD record lists one version: EasyFTP Server 1.7.0.2, from the EasyFTP Server project. The affected component is the MKD command handler. MKD is the FTP command that creates a directory.
The weakness is CWE-120, a buffer copy without checking the size of the input. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The privileges required are low, which fits the public Exploit-DB entry number 17354. Its title describes an authenticated buffer overflow in EasyFTP Server 1.7.0.2, dated June 2011. So a login on the server is needed.
The VulDB wording says critical, while NVD scores the issue 6.3, which is Medium. I could not load the VulDB page, so I am relying on the record text. Both ratings are published.
There is no vendor advisory in the record and no fixed version.
How to check if you're exposed
EasyFTP is a standalone Windows application. Look for it on file servers, build machines and older desktops.
tasklist | findstr /i easyftp
Then open the program and read the version. 1.7.0.2 is the version named in the record. The record says nothing about other versions, so do not read that as a clean bill of health.
On the network side, look for hosts answering on the FTP port you configured, and ask each owner what it is for. Any FTP service open to the internet deserves a second look.
What to do now
- Find every EasyFTP instance and confirm whether it is still used.
- Retire it where you can, and move users to a maintained transfer service such as an SFTP server that still gets updates.
- If it must stay, restrict it to a VPN or a short allowed list of addresses.
- Remove unused accounts and avoid sharing logins, since exploitation needs an account.
- Run the service under an account with limited permissions, so a memory corruption bug has less to work with.
Why it matters
A buffer overflow in a command handler happens when the server copies a value from the client, here the argument of MKD, into a fixed size memory area without checking its length. Data spills past the end of the area and can corrupt other memory. In unprotected programs, that can lead to code running with the service's privileges.
The score is held down by the login requirement, but the combination is a concern: a public exploit, a network service, and a product with no confirmed fix. FTP accounts are also often shared or weakly protected. This CVE is not on the CISA Known Exploited Vulnerabilities list, and nothing I read says it was exploited in the wild.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages in a project and flags known vulnerabilities, which helps when you are not sure what a codebase pulls in.
Quick check
Do I need an account to trigger CVE-2011-10005?
The NVD vector says low privileges are required, and the public Exploit-DB entry is titled as authenticated. Treat shared or weak FTP logins as part of the risk.
Is there a patched EasyFTP release?
I could not confirm one. The record lists only 1.7.0.2 and names no fix. Plan to replace the product.
Sources
- Gold entry for CVE-2011-10005
- Exploit-DB 17354, EasyFTP Server 1.7.0.2 authenticated buffer overflow
- NVD record for CVE-2011-10005
Last reviewed: 19 October 2026.
