CVE-2011-2523

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 96.18%
EPSS Percentile: 99.88%
CISA KEV: Not listed

Description

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 28-Nov-2019 04:15
Last Modified: 17-Jun-2026 06:31
EPSS Date: 2026-11-01
CWE: CWE-78

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

vsftpd_project / vsftpd Source: NVD CPE · affected
Version / affected range: 2.3.4
cpe:2.3:a:vsftpd_project:vsftpd:2.3.4:*:*:*:*:*:*:*
debian / debian_linux Source: NVD CPE · affected
Version / affected range: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
debian / debian_linux Source: NVD CPE · affected
Version / affected range: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
debian / debian_linux Source: NVD CPE · affected
Version / affected range: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

References

Last enrichment sync: 02-Nov-2026 06:13
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

First, vsftpd 2.3.4 backdoor (CVE-2011-2523) is flagged as VULNERABLE and Exploitable — the script executes id as the shell command and receives uid=0(root) gid=0(root), confirming remote root code execution without any Using ShellGPT and Nmap for AI-Assisted Network Reconnaissance

CVE (1)

MITRE ATT&CK (2)

Vendors (1)

Products (1)

Tools (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.