Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
CISA added five Flax Typhoon-exploited flaws to the KEV catalog, with a federal patch deadline of October 11.
86
CVE-2015-3306
Arbitrary file read/write via ProFTPD 1.3.5 mod_copy
CISA: ProFTPD Improper Access Control Vulnerability
- CVSS 3.1
- 10.0 critical
- EPSS
- 99%p100
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
The mod_copy module in ProFTPD 1.3.5 has an improper access control flaw (CWE-284) that lets remote attackers read and write arbitrary files. It is triggered by the SITE CPFR and SITE CPTO commands, which copy files without adequate authorization checks. An unauthenticated remote attacker can disclose or overwrite sensitive files and, with a CVSS 3.1 score of 10.0 and changed scope, can fully affect confidentiality, integrity, and availability. Systems running ProFTPD 1.3.5 with mod_copy, often internet-facing FTP servers, are affected. CISA lists it in the Known Exploited Vulnerabilities catalog (added 2026-10-08; ransomware use unknown), public proof-of-concept exploits exist, and EPSS is 96.8%.
What to do: Upgrade or replace ProFTPD 1.3.5 per current vendor guidance, or disable the mod_copy module until that is done. Keep FTP off the public internet or limit it to trusted hosts, and review logs and filesystems for unexpected copies or overwrites. Apply CISA BOD 26-04 and forensics-triage requirements, and stop using the product if mitigations are unavailable.
| Product | Affected |
|---|---|
| ProFTPD | 1.3.5 |
Estimated exposure
moderatethousands to low tens of thousands of internet-exposed ProFTPD hosts, unknown subset still on 1.3.5 — Order-of-magnitude inference from ProFTPD’s long use on Linux/Unix FTP servers and typical public scan counts of internet-exposed ProFTPD; this dataset has no install or scan totals, and only 1.3.5 with mod_copy is affected.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
KEVCISA Known Exploited Vulnerability
- Affected
- ProFTPD ProFTPD
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Products
- fedora, debian linux, tumbleweed, linux enterprise server, proftpd
- Weakness
- CWE-284
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
In the news
8 storiesFBI disrupts Chinese hacking tools used to breach critical infrastructure
FBI seized Flax Typhoon domains for tools used in critical-infrastructure intrusions.
86
US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide
FBI seized seven Flax Typhoon-linked domains as seven governments warned of PRC data theft.
82
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
Joint advisory says Integrity Technology Group-enabled Chinese actors steal data from critical infrastructure using botnets and hands-on hacking.
82
FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails
FBI and six countries say China-linked Integrity Technology Group stole emails and shared them via a third-party portal.
79
U.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog
CISA added five exploited ProFTPD, ONLYOFFICE, Strapi, Struts, and BIND flaws to the KEV catalog.
78
47
47