CVE-2024-1016 is a medium severity denial of service flaw, scored 5.3, in Solar FTP Server 2.1.1 and 2.1.2. The public record names no fixed version. Restrict network access to the product, check your installed version against the one named in the record, and watch the vendor or project page for a patch.
What's affected
Affected: Solar FTP Server 2.1.1 and 2.1.2. The record's CVSS 3.1 score is 5.3 (medium), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The record names the PASV command handler. The weakness is filed as CWE-404.
Fixed version: The record says a patch is recommended but names no fixed version. Check the vendor for a release.
The record's kev flag is false, so this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
- Find installs of the server program and confirm the version number against the one above.
- Check whether the FTP port is open to untrusted networks, including the internet.
- Check whether the service port is reachable from untrusted networks. Review service logs for crashes or restarts, and set up an alert for the service going down.
What to do now
- Take the product off the internet if it is exposed. Put it behind a VPN or an allow list of known addresses.
- Restrict access at the network layer to the people and systems that need it.
- Watch the vendor or project page for a fixed release, and apply it when one appears. The record does not confirm any patch, so check the source directly.
- Review logs for the signs above and rotate administrator credentials if you see anything unusual.
- Add the product to your inventory and monitoring so a future fix or advisory reaches you. A free in-browser dependency scan covers the third party packages in software you build, though it does not inspect device firmware.
Why it matters
A denial of service flaw lets a remote client make the service stop responding, usually through input that the server fails to handle cleanly. For a small server program, one malformed command or username can be enough to crash the process.
The impact is availability only. That matters most when the service is exposed to the internet or to untrusted networks, and less when it is limited to a trusted segment. File transfer servers are often forgotten once set up, so exposure tends to outlast the people who installed them.
The record notes that an exploit has been disclosed publicly, which means the technique is known. The record does not say it is exploited in the wild.
Quick check
Is this CVE exploited in the wild?
The record's kev flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports active exploitation. The record does say a public exploit exists. That is a reason to patch or contain it soon, not a report of attacks.
What if there is no patch?
Reduce exposure. Remove internet access, restrict the network, apply the log and credential checks above, and plan to replace the product if it holds sensitive data.
Sources
- Safeguard Gold entry for CVE-2024-1016, built from the NVD record
- NVD record fields: description, CVSS 3.1 vector, CWE list and CPE product data. I did not fetch the researcher write ups listed in the record, so the details above are limited to what the record states.
Last reviewed: 19 October 2026.
