CVE-2011-10029CWE-134

Solar FTP Server <= 2.1.1 Malformed USER Denial of Service

High · published August 20, 2025

CVSS v4.0
8.7
EPSS
1%
Percentile
64.6
In the wild
Unconfirmed
What it is

Solar FTP Server fails to properly handle format strings passed to the USER command. When a specially crafted string containing format specifiers is sent, the server crashes due to a read access violation in the __output_1() function of sfsservice.exe. This results in a denial of service (DoS) condition.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.01080 · 64.6th percentile
Weakness
CWE-134 · Use of Externally-Controlled Format String
Published
2025-08-20T15:40Z
EPSS history
Timeline
  • 20 AUG 15:40Z
    Solar FTP Server <= 2.1.1 Malformed USER Denial of Service
    cvelistv5