CVE-2009-4775
Format string vulnerability in Ipswitch WS_FTP Professional 12 before 12.2 allows remote...
CVE-2009-4775 is a medium vulnerability (CVSS 4.3) in Ipswitch Ws Ftp, published April 21, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.61%, the 93rd percentile. No source names a fixed version.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 5.61%EPSS, 93rd percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
Format string vulnerability in Ipswitch WS_FTP Professional 12 before 12.2 allows remote attackers to cause a denial of service (crash) via format string specifiers in the status code portion of an HTTP response.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Ipswitch WS_FTP 12 Professional - Remote Format String (PoC) | 2009-09-09 |
What each source reports
NVD Score used
Format string vulnerability in Ipswitch WS_FTP Professional 12 before 12.2 allows remote attackers to cause a denial of service (crash) via format string specifiers in the status code portion of an HTTP response.
- Record
CVE-2009-4775- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-134
- Updated
- 2026-11-02
CVE ListNo score
Format string vulnerability in Ipswitch WS_FTP Professional 12 before 12.2 allows remote attackers to cause a denial of service (crash) via format string specifiers in the status code portion of an HTTP response.
- Record
CVE-2009-4775- Updated
- 2026-11-02
EUVDEUVD-2009-4738No score
Format string vulnerability in Ipswitch WS_FTP Professional 12 before 12.2 allows remote attackers to cause a denial of service (crash) via format string specifiers in the status code portion of an HTTP response.
- Record
EUVD-2009-4738- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cqjc-hxf6-jx3wNo score
Format string vulnerability in Ipswitch WS_FTP Professional 12 before 12.2 allows remote...
Format string vulnerability in Ipswitch WS_FTP Professional 12 before 12.2 allows remote attackers to cause a denial of service (crash) via format string specifiers in the status code portion of an HTTP response.
- Record
GHSA-cqjc-hxf6-jx3w- Weakness
- CWE-134
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
docs.ipswitch.com/WS_FTP%20122/ReleaseNotes/English/index.htm?k_id=ipswitch_com_ftp_documents_worldwide_ws_ftp122releasenotesenglish
exchange.xforce.ibmcloud.com/vulnerabilities/53098
packetstormsecurity.org/0909-exploits/nocoolnameforawsftppoc.pl.txt
exploit-db.com/exploits/9607
securityfocus.com/bid/36297
nvd.nist.gov/vuln/detail/CVE-2009-4775
github.com/advisories/GHSA-cqjc-hxf6-jx3w