Medium severity5.5NVD Advisory· Published Jan 21, 2020· Updated Jun 17, 2026

CVE-2020-6857

Description

CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-coded in the binary.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Taskautomation/Carbonftp
cpe:2.3:a:taskautomation:carbonftp:1.4:*:*:*:*:*:*:*
CarbonFTP/CarbonFTPdescription
Neowise/CarbonFTPllm-fuzzy
Range: =1.4

Patches

Vulnerability mechanics

References

hyp3rlinx.altervista.orgnvdExploitThird Party Advisory
packetstormsecurity.com/files/156015/Neowise-CarbonFTP-1.4-Insecure-Proprietary-Password-Encryption.htmlnvdExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/157321/Neowise-CarbonFTP-1.4-Insecure-Proprietary-Password-Encryption.htmlnvdExploitThird Party AdvisoryVDB Entry
seclists.org/fulldisclosure/2020/Jan/29nvdExploitMailing ListThird Party Advisory
seclists.org/fulldisclosure/2020/Jan/35nvdExploitMailing ListThird Party Advisory
seclists.org/bugtraq/2020/Jan/30nvdExploitMailing ListThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.001
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000