CVE-2012-10055

Description

ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending a specially crafted username containing format specifiers, a remote attacker can overwrite a hardcoded function pointer in memory (specifically WSACleanup from Ws2_32.dll). This allows the attacker to redirect execution flow and bypass DEP protections using a ROP chain, ultimately leading to arbitrary code execution. The vulnerability is exploitable without authentication and affects default configurations.

PUBLISHED Reserved 2025-08-11 | Published 2025-08-13 | Updated 2025-08-14 | Assigner VulnCheck

Problem types

CWE-134 Use of Externally-Controlled Format String

Product status

Credits

ChaoYi Huang finder

References

raw.githubusercontent.com/...ndows/ftp/comsnd_ftpd_fmtstr.rb exploit

www.exploit-db.com/exploits/19024 exploit

www.exploit-db.com/exploits/19177 exploit

web.archive.org/web/20120317214524/http://ftp.comsnd.com/ product

www.vulncheck.com/...sories/comsndftp-user-format-string-rce third-party-advisory

cve.org (CVE-2012-10055)

nvd.nist.gov (CVE-2012-10055)

Download JSON