CVE-2012-10030 is a critical (CVSS 9.8) set of design flaws in FreeFloat FTP Server. It accepts empty credentials, defaults to the root of the C: drive and restricts neither file type nor destination, which allows uploads that Windows then executes as SYSTEM. No fixed version is confirmed.
What's affected
FreeFloat FTP Server, with an undefined version range, per the record and VulnCheck. Because the problem is in the server's design, treat every copy as affected.
The record describes three flaws that stack: it accepts empty credentials, it defaults a user's access to the root of the C: drive, and it imposes no limits on file type or destination path. It also says files placed in sensitive Windows folders, including the system32 and wbem mof locations, are processed by Windows Management Instrumentation, which runs them with SYSTEM level rights.
I could not confirm a fixed release. Use the vendor's site to check the product's status. The related memory flaw CVE-2012-10023 affects version 1.0.0. The attack path in the record depends on two Windows behaviours working together, so removing either the unsafe server or the permissive file write location breaks the chain.
How to check if you're exposed
Find FreeFloat on Windows hosts through the installed programs list or by searching for the server executable. Then confirm the FTP port is open and check how the server is configured:
nmap -sV -p 21 --open 10.0.0.0/24
On any host you find, look at the server's user and permission settings. Empty passwords, a home directory set to the drive root and write access are the three conditions in the record. If you see them, treat the host as exposed to anyone who can reach port 21.
Review the Windows folders the record names for files you do not recognise, but treat that as a hunt for evidence, not as a substitute for retiring the server.
What to do now
- Find every FreeFloat FTP Server and who relies on it.
- Retire it, or replace it with a maintained server that has per-user home directories, strong authentication and encrypted transfer.
- If it must stay for now, require passwords, set the home directory to a dedicated folder and remove write access to system paths.
- Block port 21 from untrusted networks.
- Inspect the host for unknown files in Windows system folders and for unexpected WMI activity, and rebuild it if you find any.
Why it matters
This record carries three weakness labels: CWE-306 (Missing Authentication for Critical Function), CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-732 (Incorrect Permission Assignment for Critical Resource). None of them is a memory bug. Each is a configuration or design decision that is unsafe by default.
The chain works because each flaw removes a barrier. No password means no identity. A drive root home directory means no containment. No file type checks means anything can be written. Then an operating system feature that automatically processes files in certain folders turns a file write into code execution.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild, though public exploit material is referenced. The takeaway for any file server is the same: least privilege folders, real authentication, and no write access to system paths.
Quick check
Is this a memory corruption bug?
No. The record describes design flaws: empty credentials, a drive root home directory and no upload restrictions.
Is there a fixed version?
The version range is undefined and I could not confirm a patch. Plan to retire the server.
Sources
Last reviewed: 19 October 2026.
