CVE-2000-0573
The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format...
CVE-2000-0573 is a high vulnerability (CVSS 10.0) in Hp Hp-ux, published July 7, 2000. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 96.2%, the 99th percentile. No source names a fixed version.
The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitrary commands via the SITE EXEC command.
Exploit likelihood
What each source reports
NVD Score used
The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitrary commands via the SITE EXEC command.
- Record
CVE-2000-0573- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitrary commands via the SITE EXEC command.
- Record
CVE-2000-0573- Updated
- 2026-11-02
EUVDEUVD-2000-0569 No score
The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitrary commands via the SITE EXEC command.
- Record
EUVD-2000-0569- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7g9x-54rv-3848 No score
The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format...
The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitrary commands via the SITE EXEC command.
- Record
GHSA-7g9x-54rv-3848- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WU-FTPD - Site EXEC/INDEX Format String (Metasploit) | 2010-11-30 |
| Exploit-DB | WU-FTPD 2.4.2/2.5 .0/2.6.0 - Remote Format String Stack Overwrite (1) | 1999-10-15 |
| Exploit-DB | WU-FTPD 2.4.2/2.5 .0/2.6.0 - Remote Format String Stack Overwrite (2) | 2000-09-26 |
| Exploit-DB | WU-FTPD 2.4.2/2.5 .0/2.6.0 - Remote Format String Stack Overwrite (3) | 2001-05-04 |
| Exploit-DB | WU-FTPD 2.6.0 - Remote Command Execution | 2000-11-21 |
| Exploit-DB | WU-FTPD 2.6.0 - Remote Format Strings | 2001-01-03 |
| Exploit-DB | BeroFTPD 1.3.4(1) (Linux x86) - Remote Code Execution | 2001-05-08 |
| Metasploit | WU-FTPD SITE EXEC/INDEX Format String Vulnerability | 2000-06-22 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
References
cert.org/advisories/CA-2000-13.html
marc.info?l=bugtraq&m=96299933720862&w=2
redhat.com/support/errata/RHSA-2000-039.html
calderasystems.com/support/security/advisories/CSSA-2000-020.0.txt
archives.neohapsis.com/archives/bugtraq/2000-07/0017.html
Show 8 moreShow less
securityfocus.com/bid/1387
exchange.xforce.ibmcloud.com/vulnerabilities/4773
nvd.nist.gov/vuln/detail/CVE-2000-0573
github.com/advisories/GHSA-7g9x-54rv-3848