CVE-2000-0573
The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format...
CVE-2000-0573 is a high vulnerability (CVSS 10.0) in Hp Hp-ux, published July 7, 2000. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 96.2%, the 99th percentile. No source names a fixed version.
- Severity
- 10.0 HighCVSS 2.0, NVD
- Exploit chance
- 96.2%EPSS, 99th percentile
- Exploitation
- None known8 public exploits
- Fixed in
- No fix listedNo source names one
Description
The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitrary commands via the SITE EXEC command.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WU-FTPD 2.4.2/2.5 .0/2.6.0 - Remote Format String Stack Overwrite (1) | 1999-10-15 |
| Metasploit | WU-FTPD SITE EXEC/INDEX Format String Vulnerability | 2000-06-22 |
| Exploit-DB | WU-FTPD 2.4.2/2.5 .0/2.6.0 - Remote Format String Stack Overwrite (2) | 2000-09-26 |
| Exploit-DB | WU-FTPD 2.6.0 - Remote Command Execution | 2000-11-21 |
| Exploit-DB | WU-FTPD 2.6.0 - Remote Format Strings | 2001-01-03 |
| Exploit-DB | WU-FTPD 2.4.2/2.5 .0/2.6.0 - Remote Format String Stack Overwrite (3) | 2001-05-04 |
| Exploit-DB | BeroFTPD 1.3.4(1) (Linux x86) - Remote Code Execution | 2001-05-08 |
| Exploit-DB | WU-FTPD - Site EXEC/INDEX Format String (Metasploit) | 2010-11-30 |
What each source reports
NVD Score used
The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitrary commands via the SITE EXEC command.
- Record
CVE-2000-0573- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE ListNo score
The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitrary commands via the SITE EXEC command.
- Record
CVE-2000-0573- Updated
- 2026-11-02
EUVDEUVD-2000-0569No score
The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitrary commands via the SITE EXEC command.
- Record
EUVD-2000-0569- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7g9x-54rv-3848No score
The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format...
The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitrary commands via the SITE EXEC command.
- Record
GHSA-7g9x-54rv-3848- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
cert.org/advisories/CA-2000-13.html
marc.info?l=bugtraq&m=96299933720862&w=2
redhat.com/support/errata/RHSA-2000-039.html
calderasystems.com/support/security/advisories/CSSA-2000-020.0.txt
archives.neohapsis.com/archives/bugtraq/2000-07/0017.html
Show 8 moreShow less
securityfocus.com/bid/1387
exchange.xforce.ibmcloud.com/vulnerabilities/4773
nvd.nist.gov/vuln/detail/CVE-2000-0573
github.com/advisories/GHSA-7g9x-54rv-3848