CVE-2013-10042 is a critical (CVSS 9.8) stack-based buffer overflow in freeFTPd 1.0.10 and earlier. A long password sent with the FTP PASS command is not length checked, which can cause denial of service or code execution. The record says exploitation needs the anonymous account enabled. No fixed version is confirmed.
What's affected
freeFTPd version 1.0.10 and earlier, per the record and VulnCheck. The flaw is in the handling of the FTP PASS command.
The record says exploitation requires the anonymous user account to be enabled. That matters for your risk: a server with anonymous login turned off is harder to reach with this bug, although upgrading or retiring the server is still the safer path.
I could not confirm a fixed release from the sources available. Check the product's own site for its status.
How to check if you're exposed
Check the freeFTPd version on the host, through the application or the installed programs list. Version 1.0.10 or earlier is in scope.
Then check whether anonymous login is enabled in the server's user settings. You can also test from a trusted machine:
ftp <server-address>
If the server accepts the user name anonymous, the condition in the record is met. Only test servers you own.
Look at your firewall to see which networks can reach port 21 on this host.
What to do now
- Find all freeFTPd servers and their versions.
- Disable the anonymous account unless it is truly needed.
- Check with the vendor for a fixed build. If none exists, replace the server with a maintained product.
- Restrict port 21 to known source addresses.
- Review the host for signs of crashes or unexpected processes.
Why it matters
The class is CWE-121 (Stack-based Buffer Overflow). The password string is copied into a fixed buffer without a length check, so a long value overwrites nearby stack memory. In the mild case the process crashes, which is a denial of service. In the worse case, the attacker steers execution.
Notice the condition attached to this record: anonymous login must be on. Many FTP bugs sit behind a precondition like that. It is a good reminder that turning off features you do not use is a real control, not housekeeping.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild, though public exploit material is referenced.
Quick check
Do I need anonymous access enabled for this to work?
Yes, according to the record. Disabling the anonymous account reduces exposure but does not replace upgrading or retiring the server.
Can this crash the server?
The record says it can lead to denial of service or arbitrary code execution.
Sources
Last reviewed: 19 October 2026.
