What’s Vulnerable › Vulnerabilities

CVE-2010-0039

• Severity: low (CVSS 2.6 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2010-12-22 · updated 2026-06-16
• Weakness: CWE-264

Description

The Application-Level Gateway (ALG) on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware before 7.5.2 modifies PORT commands in incoming FTP traffic, which allows remote attackers to use the device's IP address for arbitrary intranet TCP traffic by leveraging write access to an intranet FTP server.

Affected products

• Apple Airport Express: all versions
• Apple Airport Express Base Station Firmware: through 7.4.2; 3.84, 4.0.9, 6.1, 6.3, 7.3.2, 7.4.1
• Apple Airport Extreme: all versions
• Apple Airport Extreme Base Station Firmware: 5.5, 5.7
• Apple Time Capsule: all versions

References

• http://lists.apple.com/archives/security-announce/2010//Dec/msg00001.html
• http://support.apple.com/kb/HT4298
• http://www.securitytracker.com/id?1024907
• http://lists.apple.com/archives/security-announce/2010//Dec/msg00001.html
• http://support.apple.com/kb/HT4298
• http://www.securitytracker.com/id?1024907

Get alerted when CVE-2010-0039 or the next vulnerability affects your stack