CVE-2010-2073: Debian Pyftpd

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

auth_db_config.py in Pyftpd 0.8.4 contains hard-coded usernames and passwords for the (1) test, (2) user, and (3) roxon accounts, which allows remote attackers to read arbitrary files from the FTP server.

Affected products

• Debian Pyftpd: version 0.8.4 only

Published 2010-06-16. Last modified 2026-06-16.