EIP-2026-103201

PRE-CVE

ProFTPd 1.x - 'mod_tls' Remote Buffer Overflow

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-103201. PoCs published by netris.

AI-analyzed exploit summary This exploit targets a pre-authentication buffer overflow vulnerability in ProFTPd with mod_tls. It uses a maliciously crafted X.509 certificate to trigger the overflow and execute shellcode, which spawns a bindshell on port 36864.

Description

ProFTPd 1.x - 'mod_tls' Remote Buffer Overflow

Exploits (1)

exploitdb WORKING POC VERIFIED

by netris · cremotelinux

https://www.exploit-db.com/exploits/4312

View Code ZIP pw:eip

This exploit targets a pre-authentication buffer overflow vulnerability in ProFTPd with mod_tls. It uses a maliciously crafted X.509 certificate to trigger the overflow and execute shellcode, which spawns a bindshell on port 36864.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Racy

Target: ProFTPd with mod_tls (versions unspecified, likely older versions)

No auth needed

Prerequisites: Target must be running ProFTPd with mod_tls · SSL/TLS must be enabled on the target

MITRE ATT&CK

T1189 - Drive-by Compromise T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026