Vulnerability record · CVE-2006-5000 · published 26 September 2006
CVE-2006-5000: WS_FTP Server buffer overflows in XCRC, XMD5 and XSHA1 commands
Ipswitch · Ws Ftp Server
WS_FTP Server 5.05 before Hotfix 1, and possibly versions back to 5.0, contains multiple buffer overflows reachable through the XCRC, XMD5 and XSHA1 FTP commands. The record does not specify the exact overflow mechanism or the resulting impact, so defenders should treat the flaw as a memory-corruption issue in the server's command handling.
Description
Multiple buffer overflows in WS_FTP Server 5.05 before Hotfix 1, and possibly other versions down to 5.0, have unknown impact and remote authenticated attack vectors via the (1) XCRC, (2) XMD5, and (3) XSHA1 commands. NOTE: in the early publication of this identifier on 20060926, the description was used for the wrong issue.
AV:N/AC:L/Au:S/C:P/I:P/A:P
Automated analysis
medium priorityCVSS 2.0 rates this 6.5 (medium) with authenticated remote access, but the high EPSS percentile and memory-corruption class warrant prompt patching.
What it is
WS_FTP Server 5.05 before Hotfix 1, and possibly versions back to 5.0, contains multiple buffer overflows reachable through the XCRC, XMD5 and XSHA1 FTP commands. The record does not specify the exact overflow mechanism or the resulting impact, so defenders should treat the flaw as a memory-corruption issue in the server's command handling.
Impact
An attacker who can issue the affected FTP commands may corrupt server memory, with the record stating only unknown impact rather than confirmed code execution or denial of service.
Attack surface
The flaw is reached remotely over the network through FTP commands, and the CVSS vector requires authentication (Au:S), so a valid FTP account is needed. No user interaction is indicated.
Exploitation
The record is not listed in CISA KEV and no public exploit is confirmed by the reference tags, though EPSS is high at 0.6462 (99.2nd percentile), suggesting elevated likelihood of exploitation activity.
What to do
- Apply WS_FTP Server 5.05 Hotfix 1 or later, per the vendor patch reference.
- If patching is delayed, restrict FTP access to trusted accounts and networks and disable or block the XCRC, XMD5 and XSHA1 commands where possible.
- Audit FTP accounts for least privilege and remove unused or shared credentials.
- Monitor vendor advisories for updated guidance on affected versions.
Detection
- Review FTP server logs for XCRC, XMD5 and XSHA1 commands, especially from unusual accounts or source addresses.
- Alert on FTP server process crashes or abnormal termination correlated with those commands.
- Hunt for repeated or malformed XCRC/XMD5/XSHA1 arguments that may indicate fuzzing or exploit attempts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-5000 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-5000), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
