CVE-2007-6741

The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client, which might allow remote authenticated users to conduct FTP bounce attacks via crafted FTP data, as demonstrated by an FTP bounce attack against a NAT server, a related issue to CVE-1999-0017.

Published: 2010-10-19 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]

Conclusion & alert: CVE-2007-6741 is rated Moderate Risk (53.5/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 1.77%). Core evidence: EPSS rose +1.16% over the last day, indicating growing attacker interest. Mandatory action: Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2007-6741

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.61% 1.77% +1.16%
2 2025-03-30 0.67% 0.61% -0.06%
3 2025-03-29 0.67%

Full EPSS history (11 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2007-6741

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
6.5 2.0 MEDIUM
AV:N/AC:L/Au:S/C:P/I:P/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:S)
A single authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:P)
Partial availability impact.
8.0 6.4 [email protected]

Weakness enumeration for CVE-2007-6741

GitHub Security Advisory for CVE-2007-6741

GHSA-8xgx-75qw-6268 · Severity: medium · Ecosystem: pip — Improper privilege management in pyftpdlib

OS Trackers for CVE-2007-6741

vendor priority summary link
debian unimportant CVE-2007-6741 unimportant priority: Debian including 1 source packages (python-pyftpdlib), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2007-6741

Affected software / configurations for CVE-2007-6741

Vendor Product Version Raw CPE
g.rodola pyftpdlib <= 0.1.1 cpe:2.3:a:g.rodola:pyftpdlib:*:*:*:*:*:*:*:*
g.rodola pyftpdlib 0.1 cpe:2.3:a:g.rodola:pyftpdlib:0.1:*:*:*:*:*:*:*

References for CVE-2007-6741

cvelogic Threat Intelligence