CVE-2012-10023 is a critical (CVSS 9.8) stack-based buffer overflow in FreeFloat FTP Server 1.0.0. An overly long username in the USER command overflows a buffer during authentication, so a remote user can overwrite memory before logging in. No fixed version is confirmed in the record, so plan to retire the server.
What's affected
FreeFloat FTP Server version 1.0.0, per the record. The flaw is in the handling of the USER command, which is the first step of any FTP login, so it is reachable before authentication.
The record does not name a fixed version, and the vendor pages in its references are archived copies. I could not confirm that a patched release exists. Treat any copy of this server as vulnerable and check whether the vendor still maintains it. An older advisory listed in the references dates from 2010, which shows how long the issue has been known.
A second FreeFloat issue with different causes, CVE-2012-10030, covers its unsafe default configuration.
How to check if you're exposed
Find FreeFloat installs on Windows hosts by checking installed programs and by looking for the server's executable on disk. Then check which hosts answer on the FTP port:
nmap -sV -p 21 --open 10.0.0.0/24
The banner in the output often names the server. Only scan networks you own or have permission to test.
If you find one, check whether it is reachable from the internet, and who depends on it. Many of these servers were installed for a single transfer job years ago.
What to do now
- Find every FreeFloat FTP Server and the business process that uses it.
- Check with the vendor for a fixed build. If none exists, plan to retire the server.
- Move the transfer job to a maintained product that supports encrypted transfer.
- Until then, block port 21 from the internet and allow only the specific source addresses that need it.
- Review the host for unexpected processes or new accounts if it was exposed.
Why it matters
The class of weakness is CWE-121 (Stack-based Buffer Overflow). The server reads the username into a fixed-size buffer and does not check its length. The USER command runs before login, so the code path is open to anyone who can connect.
Small, free FTP servers on Windows were common in 2010, and many outlived their owners' memory of them. Their risk is not the single CVE but the pattern: unmaintained software, plain text protocol, and often broad file system access. The record does not mark this CVE as CISA KEV, and makes no claim of exploitation in the wild, though public exploit material is referenced.
The right control is inventory first, retirement second. A server you cannot find cannot be patched.
Quick check
Is there a patch for FreeFloat FTP Server 1.0.0?
I could not confirm one from the available sources. Check with the vendor and plan to replace the server.
Does an attacker need an account?
The overflow is in the USER command, which comes before authentication, so no valid account is needed per the record.
Sources
Last reviewed: 19 October 2026.
