CVE-2006-2407: Stack-based buffer overflow in (1) WeOnlyDo wodSSHServer ActiveX Component 1.2.7 and 1.3.3 DEMO, as used in ot

This week

HIGH 7.5DOWNGRADEDOWNGRADEDOWNGRADE

CVE-2006-2407 is a high-severity flaw (CVSS 7.5) affecting freeftpd, freesshd, wodsshserver. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Stack-based buffer overflow in (1) WeOnlyDo wodSSHServer ActiveX Component 1.2.7 and 1.3.3 DEMO, as used in other products including (2) FreeSSHd 1.0.9 and (3) freeFTPd 1.0.10, allows remote attackers to execute arbitrary code via a long key exchange algorithm string.

Why this priority

High severity
EPSS top 1%: very likely to be exploited
Public exploit reference

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	7.5 (High)
EPSS exploit chance	71.9% (top 1%)
CISA exploited list	No
Weakness	CWE-119
Published	2006-05-16
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: freeftpd · freesshd · weonlydo

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2006-05-16 10:02 UTCPublished CVE record published
2026-06-16 22:24 UTCUpdated Record last modified

freeftpd freeftpd DOWNGRADE

Affected: 1.0.10

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.0.10

1. Check installed version

apt-cache policy freeftpd || rpm -q freeftpd || freeftpd --version

2. No fixed release: DOWNGRADE to a release before 1.0.10 (Debian / Ubuntu)

apt-cache madison freeftpd sudo apt install freeftpd=<VERSION_BEFORE_1.0.10> sudo apt-mark hold freeftpd

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list freeftpd sudo dnf downgrade freeftpd-<VERSION_BEFORE_1.0.10> sudo dnf versionlock add freeftpd

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

freesshd freesshd DOWNGRADE

Affected: 1.0.9

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.0.9

1. Check installed version

apt-cache policy freesshd || rpm -q freesshd || freesshd --version

2. No fixed release: DOWNGRADE to a release before 1.0.9 (Debian / Ubuntu)

apt-cache madison freesshd sudo apt install freesshd=<VERSION_BEFORE_1.0.9> sudo apt-mark hold freesshd

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list freesshd sudo dnf downgrade freesshd-<VERSION_BEFORE_1.0.9> sudo dnf versionlock add freesshd

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

weonlydo wodsshserver DOWNGRADE

Affected: 1.2.7 · 1.3.3_demo

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.2.7

1. Check installed version

apt-cache policy wodsshserver || rpm -q wodsshserver || wodsshserver --version

2. No fixed release: DOWNGRADE to a release before 1.2.7 (Debian / Ubuntu)

apt-cache madison wodsshserver sudo apt install wodsshserver=<VERSION_BEFORE_1.2.7> sudo apt-mark hold wodsshserver

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list wodsshserver sudo dnf downgrade wodsshserver-<VERSION_BEFORE_1.2.7> sudo dnf versionlock add wodsshserver

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Exploit-DB: freeFTPd 1.0.10 - Key Exchange Algorithm String Buffer Overflow (Metasploit)
Exploit-DB: freeSSHd 1.0.9 - Key Exchange Algorithm Buffer Overflow
Exploit-DB: freeSSHd 1.0.9 - Key Exchange Algorithm String Buffer Overflow (Metasploit)
Metasploit: FreeFTPd 1.0.10 Key Exchange Algorithm String Buffer Overflow
Metasploit: FreeSSHd 1.0.9 Key Exchange Algorithm String Buffer Overflow

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2006-2407?

freeftpd: downgrade or apply the listed mitigation; freesshd: downgrade or apply the listed mitigation; wodsshserver: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2006-2407 being exploited?

CVE-2006-2407 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2006-2407 affect?

CVE-2006-2407 affects freeftpd, freesshd, wodsshserver. Severity is high (CVSS 7.5). Stack-based buffer overflow in (1) WeOnlyDo wodSSHServer ActiveX Component 1.2.7 and 1.3.3 DEMO, as used in other products including (2) FreeSSHd 1.0.9 and (3) freeFTPd 1.0.10, allows remote attackers to execute arbitrary code via a long ke

How urgent is CVE-2006-2407?

Priority 56/100. High severity; EPSS top 1%: very likely to be exploited; Public exploit reference

Related CVEs

CVE-2022-27052 HIGH 7.8 UPGRADE FreeFtpd version 1.0.13 and below contains an unquoted service path vulnerability which allows local users to
CVE-2019-19383 HIGH 8.8 DOWNGRADE freeFTPd 1.0.8 has a Post-Authentication Buffer Overflow via a crafted SIZE command (this is exploitable even
CVE-2013-10042 CRITICAL 9.8 UPGRADE A stack-based buffer overflow vulnerability exists in freeFTPd version 1.0.10 and earlier in the handling of t
CVE-2012-6067 HIGH 10.0 UPGRADE freeFTPd.exe in freeFTPd through 1.0.11 allows remote attackers to bypass authentication via a crafted SFTP se
CVE-2005-3812 MEDIUM 6.8 DOWNGRADE freeFTPd 1.0.10 allows remote authenticated users to cause a denial of service (null dereference and crash) vi

References

← Back to latest CVEs