CVE-2000-0573: wu-ftpd lreply format string allows remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityRemote unauthenticated command execution with a CVSS 2.0 score of 10 and very high EPSS probability makes this a top-priority patching target despite its age.

What it is

The lreply function in wu-ftpd 2.6.0 and earlier fails to sanitize an untrusted format string, letting a remote attacker inject format specifiers through the SITE EXEC command. Because the flaw is reachable over the network without authentication, it exposes the FTP service to full compromise.

Impact

An attacker can execute arbitrary commands on the FTP server, typically with the privileges of the wu-ftpd process, leading to complete loss of confidentiality, integrity and availability.

Attack surface

Reachable remotely over the network via the FTP SITE EXEC command; no authentication or user interaction is required per the CVSS vector AV:N/AC:L/Au:N.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.962 probability, 0.999 percentile), indicating strong likelihood of exploitation activity.

What to do

• Upgrade wu-ftpd to a version later than 2.6.0 or apply the vendor patch referenced in CERT CA-2000-13 and the Red Hat, Caldera, FreeBSD and NetBSD advisories.
• Disable or restrict the SITE EXEC command in the wu-ftpd configuration if it is not required.
• Restrict FTP access to trusted networks and replace plain FTP with SFTP or FTPS where possible.
• Monitor vendor advisories for HP-UX and other affected platforms and apply the corresponding patches.

Detection

• Inspect FTP server logs for SITE EXEC commands containing format string specifiers such as %n, %s or %x.
• Alert on unexpected child processes or shell activity spawned by the FTP daemon.
• Monitor network traffic for anomalous FTP command sequences targeting SITE EXEC.
• Correlate FTP authentication and command logs with host process creation events for signs of post-exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.