CVE-2020-9273
highpriority · attend · 49EPSS 0.121 · 96 %ileexploit · PoCDEEURUUSEPSS · scored 2026-10-27
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSIMATIC CP 1543-1 (incl. SIPLUS variants)siemens_psirt
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800773/ - FixedSIMATIC CP 1545-1siemens_psirt
Update to V1.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811116/ - FixedSIMATIC CP 1543-1 (incl. SIPLUS variants)cisa_csaf_ot
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800773/ - FixedSIMATIC CP 1545-1cisa_csaf_ot
Update to V1.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811116/ - MitigationSIMATIC CP 1543-1 (incl. SIPLUS variants)siemens_psirt
Disable the embedded FTP server. The server is deactivated in the default configuration
- MitigationSIMATIC CP 1545-1siemens_psirt
Disable the embedded FTP server. The server is deactivated in the default configuration
- MitigationSIMATIC CP 1543-1 (incl. SIPLUS variants)cisa_csaf_ot
Disable the embedded FTP server. The server is deactivated in the default configuration
- MitigationSIMATIC CP 1545-1cisa_csaf_ot
Disable the embedded FTP server. The server is deactivated in the default configuration
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
affected products (28)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- SSA-679335SSA-679335: Multiple Vulnerabilities in Embedded FTP Server of SIMATIC CP Modules2021-08-10csaf · siemens_psirtDE
SIMATIC CP 1543-1 and CP 1545-1 devices are affected by multiple vulnerabilities in ProFTPD, a third party component, that could allow a remote attacker to access sensitive information and execute arbitrary code. Siemens has released updates for the affected products and recommends to update to the latest versions.
- ICSA-21-222-07Siemens SIMATIC CP (Update A)2021-08-10icsa · cisa_csaf_otUS
SIMATIC CP 1543-1 and CP 1545-1 devices are affected by multiple vulnerabilities in ProFTPD, a third party component, that could allow a remote attacker to access sensitive information and execute arbitrary code. Siemens has released updates for the affected products and recommends to update to the latest versions.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (45)
External citations — patches, advisories, analysis.
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00002.htmlcnnvd
- http://www.nsfocus.net/vulndb/45952cnnvd
- http://www.openwall.com/lists/oss-security/2021/08/25/1cnnvd
- http://www.openwall.com/lists/oss-security/2021/09/06/2cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-679335.pdfcnnvd
- https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTEScnnvd
- https://github.com/proftpd/proftpd/issues/903cnnvd
- https://lists.debian.org/debian-lts-announce/2020/02/msg00022.htmlcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan