The FTP client in Rapid7’s Metasploit Framework blindly trusts the IP and port supplied in the server’s 227 Passive Mode response. A malicious FTP server can respond with an arbitrary IP:port combination, causing the Metasploit client to establish a new TCP connection to that address without verifying it against the control connection. This allows the attacker to trigger outbound connections from the operator’s machine to any host the attacker can reach, potentially exposing internal resources or allowing further pivoting.

Rapid7: Metasploit Framework. No specific producer‑reported version range is given, so all installations of the framework are potentially vulnerable until a patched release is published.

The CVSS score of 4.7 categorizes this flaw as low to moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited evidence of exploitation in the wild. The probable attack vector involves an adversary controlling an FTP server that the Metasploit client contacts; the exploit requires no special privileges beyond legitimate use of the FTP functionality, so any user running the affected framework could be impacted.