CVE-2004-2523: Openftpd FTP Server

Medium severity, CVSS 6.5. EPSS: 5.4% chance of exploitation in the next 30 days.

Format string vulnerability in the msg command (cat_message function in msg.c) in OpenFTPD 0.30.2 and earlier allows remote authenticated users to execute arbitrary code via format string specifiers in the message argument.

Affected products

• Openftpd Openftpd FTP Server: up to and including 0.30.2; version 0.29.4 only; version 0.30 only; version 0.30.1 only

Published 2004-12-31. Last modified 2026-06-16.