CVE-2006-6565

MediumPublished

FileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a wildcard argument to the (1) LIST or (2) NLST commands,...

Published: Dec 15, 2006
Updated: Aug 7, 2024
Assigning CNA: mitre
Evidence observed: Dec 11, 2006

Primary CVSS

4.0/ 10Medium

nvd · CVSS 2.0

AV:N/AC:L/Au:S/C:N/I:N/A:P

EPSS probability estimate

70.6%

High · next 30 days

Percentile: 99.4%
Model date: Oct 15, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

FileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a wildcard argument to the (1) LIST or (2) NLST commands, which results in a NULL pointer dereference, a different set of vectors than CVE-2006-6564. NOTE: CVE analysis suggests that the problem might be due to a malformed PORT command.

Sources

Repository evidence: Files: 2 · Repositories: 2

1 Module1 Template

FileZilla FTP Server Malformed PORT Denial of ServiceModule
modules/auxiliary/dos/windows/ftp/filezilla_server_port.rb
Metasploit Framework modules
ResearchEvidence observed: Sep 25, 2026Revision: b22ce1fbae63Related tool
Declared conditions
- verification: check_not_declared($.auxiliary_dos/windows/ftp/filezilla_server_port.check)
FileZilla Server < 0.9.22 - DoS via Wildcard CommandsTemplate
network/cves/2006/CVE-2006-6565.yaml
Nuclei Templates
DetectionEvidence observed: Sep 26, 2026Revision: 98ad1e0e66c3Related tool
Declared conditions
- network: tcp($.protocol_keys)
- verification: dsl($.matchers[*].type)

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.