CVE-2010-0962: Apple Airport Express

Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days.

The FTP proxy server in Apple AirPort Express, AirPort Extreme, and Time Capsule with firmware 7.5 does not restrict the IP address and port specified in a PORT command from a client, which allows remote attackers to leverage intranet FTP servers for arbitrary TCP forwarding via a crafted PORT command.

Affected products

• Apple Airport Express: version 7.5 only
• Apple Airport Extreme: version 7.5 only
• Apple Time Capsule: version 7.5 only

Published 2010-03-10. Last modified 2026-06-16.