Open&Compact FTP Server (Open-FTPD) 1.2 and earlier allows remote attackers to bypass authentication by sending (1) LIST (2) RETR (3) STOR or other commands without performing the required login steps first.