CVE-2002-2417

acFTP 1.4 - Improper Authentication

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2002-2417. PoCs published by Matthew Murphy.

AI-analyzed exploit summary This exploit demonstrates an authentication bypass vulnerability in acFTP, allowing an attacker to log in without a valid password by using specific credentials (USER private, PASS #).

Description

acFTP 1.4 does not properly handle when an invalid password is provided by the user during authentication, which allows remote attackers to hide or misrepresent certain activity from log files and possibly gain privileges.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Matthew Murphy · textremotewindows
https://www.exploit-db.com/exploits/22032

This exploit demonstrates an authentication bypass vulnerability in acFTP, allowing an attacker to log in without a valid password by using specific credentials (USER private, PASS #).

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: acFTP (version not specified)
No auth needed
Prerequisites: Network access to the vulnerable FTP server
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/6235
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/3334
Third Party Advisory vdb-entry x_refsource_xf
http://www.iss.net/security_center/static/10681.php
Third Party Advisory mailing-list x_refsource_vulnwatch
http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0088.html
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/300929

Scores

EPSS 0.0418
EPSS Percentile 89.6%

Details

CWE
CWE-287
Status published
Products (1)
acftp/acftp 1.4
Published Dec 31, 2002
Tracked Since Feb 18, 2026