CVE-2010-0962 in Time Capsule
Summary
by MITRE
The FTP proxy server in Apple AirPort Express, AirPort Extreme, and Time Capsule with firmware 7.5 does not restrict the IP address and port specified in a PORT command from a client, which allows remote attackers to leverage intranet FTP servers for arbitrary TCP forwarding via a crafted PORT command.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/02/2026
The vulnerability identified as CVE-2010-0962 represents a critical security flaw in Apple's AirPort networking hardware devices including the AirPort Express, AirPort Extreme, and Time Capsule models running firmware version 7.5. This issue stems from improper input validation within the FTP proxy server implementation that fails to properly sanitize or restrict the IP address and port parameters contained in FTP PORT commands issued by clients. The flaw exists at the network protocol level where the device acts as an intermediary between external FTP clients and internal network FTP servers, creating a potential pathway for malicious actors to exploit the device's proxy functionality.
The technical nature of this vulnerability allows remote attackers to manipulate the FTP proxy server by crafting specially formatted PORT commands that specify arbitrary IP addresses and port numbers. This occurs because the proxy server does not validate whether the destination address and port specified in the PORT command are within acceptable ranges or originate from legitimate internal network resources. The flaw essentially enables attackers to use the AirPort device as a conduit for TCP forwarding to any destination, bypassing normal network security controls and potentially exposing internal network resources to external threats. This represents a classic case of insufficient input validation and access control enforcement within network proxy services.
The operational impact of this vulnerability is significant as it allows attackers to perform unauthorized network reconnaissance and potentially gain access to internal network services that would normally be protected by network segmentation. Attackers can leverage this flaw to forward TCP connections to internal FTP servers or other network services, potentially enabling them to bypass firewalls and network security controls that typically protect internal resources from external access. The vulnerability creates a persistent backdoor mechanism that can be exploited repeatedly, making it particularly dangerous for network administrators who may not immediately detect such unauthorized forwarding activities. This type of vulnerability is classified under CWE-284 (Improper Access Control) and falls within the ATT&CK technique T1046 (Network Service Scanning) and T1071.1003 (Application Layer Protocol: File Transfer Protocol).
Mitigation strategies for this vulnerability should focus on immediate firmware updates from Apple to address the specific flaw in the FTP proxy server implementation. Network administrators should also implement additional network segmentation controls and access control lists to prevent unauthorized forwarding of traffic through the affected devices. Monitoring network traffic for unusual FTP PORT command patterns and implementing network intrusion detection systems can help identify exploitation attempts. The vulnerability highlights the importance of proper input validation in network proxy services and demonstrates how seemingly minor implementation flaws can create significant security risks in network infrastructure devices. Organizations should also consider disabling FTP proxy functionality entirely if it is not required for their network operations, as this would eliminate the attack surface associated with this specific vulnerability.