CVE-2010-20113 is a critical (CVSS 9.8) stack-based buffer overflow in the embedded web server of EasyFTP Server 1.7.0.11 and earlier. An overlong path parameter on a request for list.html can corrupt control flow without authentication. The record says version 1.7.0.12 fixed it, and the product was then renamed UplusFtp.
What's affected
EasyFTP Server 1.7.0.11 and all earlier versions, according to the record and the VulnCheck advisory. The record says the problem was resolved in 1.7.0.12, after which the product was renamed UplusFtp. VulnCheck adds that the product appears to no longer be supported.
The flaw sits in the embedded HTTP interface, not in the FTP protocol handler. Exposure depends on whether that web interface is reachable from a network you do not control. The record notes that default anonymous access means no login is needed to reach the vulnerable request path.
How to check if you're exposed
Check the version in the application and on disk. On Windows, look at the file properties of the EasyFTP executable, and check the installed programs list.
Then check whether the web interface is reachable. From a machine on a network segment you manage:
nmap -sV -p 21,80,8080 <server-address>
Seeing an HTTP service next to the FTP service on the same host is a hint that the embedded interface is turned on. Review the firewall rules in front of the host as well, since that decides who can reach it.
If you find 1.7.0.11 or earlier, treat it as vulnerable. The version number is the authoritative signal here.
If you cannot upgrade immediately, a host firewall rule that drops traffic to the web interface port from untrusted networks is a reasonable stopgap while you plan the replacement.
What to do now
- Find every EasyFTP Server install, including old file transfer boxes that nobody owns any more.
- Upgrade to 1.7.0.12 or later, which the record gives as the fix. Since the product is now UplusFtp, confirm the current build from the vendor.
- If an upgrade is not possible, block access to the embedded web interface at the firewall and retire the server as soon as you can.
- Turn off anonymous access unless it is required. The record says the default anonymous access removes the authentication barrier.
- Because the host may have been exposed, review it for unexpected processes, new accounts and changed files.
Why it matters
The root cause is CWE-121 (Stack-based Buffer Overflow). The server copies a request path into a fixed-size buffer on the stack without checking the length first. A long enough value writes past the buffer and can overwrite data that controls where the program runs next. That is why a scored-as-critical network bug needs only one unauthenticated request.
Old file servers are the typical home for bugs like this. They keep working, nobody patches them, and they are often reachable from the internet. The references on the record include public exploit material, which raises the odds that scanners will find unpatched copies. The record does not mark the CVE as CISA KEV.
Quick check
Which EasyFTP version fixes this?
The record says 1.7.0.12 resolved it. After that release the product was renamed UplusFtp.
Does this need a login?
No. The record says default anonymous access means no authentication is needed to reach the vulnerable request.
Sources
Last reviewed: 19 October 2026.
