CVE-2010-2073: auth_db_config.py in Pyftpd 0.8.4 contains hard-coded usernames and passwords for the (1) test, (2) user, a...

Security readout for executives and security teams

Pyftpd 0.8.4 shipped with built-in FTP accounts. If the service is reachable, an attacker could use those defaults to read files from the FTP server. The main business risk is unauthorized disclosure of files stored on or exposed through that server. Exposure is likely limited to systems still running Pyftpd 0.8.4 with the vulnerable authentication configuration and a network-reachable FTP service. Modern environments are less likely to run this old package, but internet-facing legacy FTP servers should be checked. Prioritize remediation for any internet-facing or partner-facing Pyftpd instance. Internal-only systems are lower urgency but still need removal or compensating controls because the weakness is a built-in credential problem, not a complex exploit chain. Mitigation focus: Inventory systems for Pyftpd 0.8.4 or bundled auth_db_config.py.; Disable or restrict network access to legacy Pyftpd services.; Remove default hard-coded accounts from any retained deployment..

Prepared

Jun 28, 2026, 02:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.