srl
FTP
FTP is a clear-text protocol for file transfer that typically runs on TCP port 21 (control channel). There are different commands and status codes in FTP, and not all commands are consistently implemented on the server — which is precisely what makes enumeration valuable: the banner, the supported command set, and the write permissions often determine the entire attack path.
2025–2026 context: FTP is legacy infrastructure that remains in production because appliances, backup systems, and industrial equipment still depend on it. The current CVE feed is dominated by two classes: FTP server implementations with unauthenticated or authenticated RCE (Wing FTP Server, CrushFTP, ProFTPD, the Windows FTP Service), and FTP client-side flaws where a malicious server attacks the connecting client (Wget PASV, GVfs PASV). The client-side class is frequently overlooked — and it turns a seemingly harmless “connect to the target FTP” into a pivot into the attacker’s own network.