Critical severity · published Feb 3, 2026
CVE-2020-37067
Filetto 1.0 - 'FEAT' Denial of Service
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
Filetto 1.0 FTP server contains a denial of service vulnerability in the FEAT command processing that allows attackers to crash the service. Attackers can send an oversized FEAT command with 11,008 bytes of repeated characters to trigger a buffer overflow and terminate the FTP service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Filetto · Utillyty
1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-37067
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-37067
www.utillyty.eu
http://www.utillyty.eu
sourceforge.net
https://sourceforge.net/projects/filetto
www.exploit-db.com
https://www.exploit-db.com/exploits/48503
www.vulncheck.com
https://www.vulncheck.com/advisories/filetto-feat-denial-of-service