Security readout for executives and security teams
Plain-English summary
Solar FTP Server can be crashed remotely by malformed login input before authentication. The business impact is service outage for any exposed FTP service using affected Solar FTP Server releases. Public exploit references exist, but the provided sources do not show active exploitation or CISA KEV listing.
Executive priority
Prioritize remediation when Solar FTP Server is internet-facing or supports business-critical file transfers. The issue is outage-focused rather than data theft, but public exploit references and unauthenticated network reachability make exposed legacy deployments operationally risky.
Technical view
The issue is a CWE-134 format string handling flaw in the FTP USER command. A crafted string can trigger a read access violation in sfsservice.exe __output_1(), causing denial of service. The bundle identifies Solar FTP Server <= 2.1.1, while affected metadata is inconsistent, so version validation matters.
Likely exposure
Exposure is limited to environments still running Flexbyte Solar FTP Server, especially internet-facing FTP services. Because the software and vendor references are old, most organizations should treat this as legacy-asset risk rather than broad modern exposure.
Exploitation context
Public Exploit-DB and Metasploit references indicate reproducible denial-of-service knowledge is public. The provided bundle marks KEV false and does not cite active exploitation. This should be handled as known public exploit availability, not confirmed in-the-wild exploitation.
Researcher notes
Do not assume all FTP servers are affected. The evidence is specific to Flexbyte Solar FTP Server and malformed USER handling. The source bundle has inconsistent affected-version metadata, so researchers should preserve exact product, version, and crash evidence when validating exposure.
Mitigation direction
- Identify any Solar FTP Server deployments and confirm exact versions.
- Upgrade from affected releases using the archived 2.1.2 vendor guidance where applicable.
- Retire or replace unsupported Solar FTP Server instances where feasible.
- Restrict FTP service exposure to trusted networks only.
- Monitor for unexpected sfsservice.exe crashes or FTP service restarts.
Validation and detection
- Inventory hosts listening for FTP and map them to server software.
- Confirm whether Solar FTP Server version is 2.1.1 or earlier.
- Check service logs and Windows crash reports for sfsservice.exe failures.
- Verify internet exposure through approved asset management or perimeter scanning.
- Document compensating controls if replacement is delayed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-134: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2011-10029 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/dos/windows/ftp/solarftp_user.rbCVE reference, VulnCheck · exploit
- https://www.exploit-db.com/exploits/16204CVE reference, VulnCheck · exploit
- https://web.archive.org/web/20111102141514/https://solarftp.com/CVE reference, VulnCheck · product
- https://web.archive.org/web/20111009122553/http://solarftp.com/blog/news/solar-ftp-server-2-1-2.htmlCVE reference, VulnCheck · vendor-advisory, patch
- https://www.vulncheck.com/advisories/solar-ftp-server-malformed-user-dosCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Externally-Controlled Format String
Use of Externally-Controlled Format String represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.