CVE-2005-3081: wzdftpd SITE command shell metacharacter command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityAuthenticated remote command execution with public exploit code and very high EPSS, though the CVSS 2.0 base score is only 4.6 and the vector is inconsistent with the description.

What it is

wzdftpd 0.5.4 fails to neutralize shell metacharacters in the SITE command, allowing command injection. An attacker who can authenticate to the FTP service can run arbitrary commands on the host, which matters because it turns a limited FTP account into host-level code execution.

Impact

An attacker gains arbitrary command execution with the privileges of the wzdftpd process, enabling data theft, service disruption or further host compromise.

Attack surface

Reached through the FTP SITE command; the description states remote authenticated users, so valid credentials are required and no user interaction beyond issuing the command is needed. The CVSS 2.0 vector is AV:L, which conflicts with the remote-authenticated wording and should be treated as a record inconsistency.

Exploitation

Not listed in CISA KEV, but EPSS is 0.76602 (99.5th percentile) and a public exploit reference is tagged Exploit, indicating known exploit code exists.

What to do

• Upgrade wzdftpd to a version later than 0.5.4 or apply the vendor/Debian fix (DSA-1006).
• If patching is not possible, disable or restrict the SITE command for untrusted accounts.
• Run wzdftpd as a low-privilege dedicated account with no shell and minimal filesystem access.
• Restrict FTP access to trusted networks and enforce strong authentication.
• Monitor and alert on SITE command usage in FTP logs.

Detection

• Search FTP logs for SITE commands containing shell metacharacters such as ;, |, &, $, ` or newlines.
• Alert on child processes spawned by the wzdftpd process, especially shells.
• Monitor for unexpected outbound connections or file writes originating from the FTP service account.
• Correlate authenticated FTP sessions with subsequent suspicious process execution on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.