CVE-2020-9273

8.8 highEPSS 12%

High (8.8). EPSS 12% chance of exploitation in the next 30 days.

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 12% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWE: CWE-416
Published: 2020-02-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
fedoraproject:fedora
opensuse:backports_sle
opensuse:leap
proftpd:proftpd
siemens:simatic_net_cp_1543-1_firmware
siemens:simatic_net_cp_1545-1_firmware

References

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00002.html
http://www.openwall.com/lists/oss-security/2021/08/25/1
http://www.openwall.com/lists/oss-security/2021/09/06/2
https://cert-portal.siemens.com/productcert/pdf/ssa-679335.pdf
https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES

Check your stack JSON