CVE-2011-2523
CriticalPublic exploitvsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
Published Apr 13, 2021 · Updated Aug 6, 2024 · Also known as TR-21-0310
Key Facts
Patch immediately- CVE-2011-2523 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Vsftpd (Vsftpd Project), Debian Linux.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 96% probability of exploitation in the next 30 days.
- Fixed versions are available, including Vsftpd NA, Vsftpd 0.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
96%
Higher than 99.8% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2011-2523 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
Affected Products
13 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| VsftpdVsftpd Project | 2.3.4, >= 2.3.4 downloaded between 20110630 and 20110703 | 0 |
| Debian LinuxDebian | 10.0, 8.0, 9.0 | n/a |
Patched Releases
Vsftpd
NA
Timeline
Publicly disclosed
Apr 13, 2021
Last updated
Aug 6, 2024
Weakness Type
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
References
- advisoryhttps://access.redhat.com/security/cve/cve-2011-2523
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2011-2523
- advisoryhttps://vigilance.fr/vulnerability/vsftpd-backdoor-in-version-2-3-4-10805
- advisoryExploitDB-49757
- advisoryhttps://www.linuxsecurity.com/advisories/debian/debian-dsa-4890-1-ruby-kramdown-security-update-03-22-41?rss
FAQ
Common Questions.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
Affected: Vsftpd (Vsftpd Project) versions 2.3.4, >= 2.3.4 downloaded between 20110630 and 20110703; Debian Linux versions 10.0, 8.0, 9.0. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Vsftpd NA, Vsftpd 0.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2011-2523 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo