CVE-2009-4769

httpdx <1.5 - Remote Code Execution

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2009-4769. PoCs published by Metasploit, jduck, including Metasploit module exploits/windows/http/httpdx_tolog_format.

AI-analyzed exploit summary This Metasploit module exploits a format string vulnerability in HTTPDX HTTP server (CVE-2009-4769) by sending a crafted HTTP request with format specifiers to corrupt memory and execute arbitrary code. It supports multiple versions of HTTPDX and includes automatic targeting via fingerprinting.

Description

Multiple format string vulnerabilities in the tolog function in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b, and 1.5 allow (1) remote attackers to execute arbitrary code via format string specifiers in a GET request to the HTTP server component when logging is enabled, and allow (2) remote authenticated users to execute arbitrary code via format string specifiers in a PWD command to the FTP server component.

Exploits (4)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16794

This Metasploit module exploits a format string vulnerability in HTTPDX HTTP server (CVE-2009-4769) by sending a crafted HTTP request with format specifiers to corrupt memory and execute arbitrary code. It supports multiple versions of HTTPDX and includes automatic targeting via fingerprinting.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: HTTPDX HTTP server (versions 1.4, 1.4.5, 1.4.6, 1.4.6b, 1.5)
No auth needed
Prerequisites: Network access to the HTTPDX server · Logging enabled for the 'moderator' user via FTP or HTTP
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16732

This Metasploit module exploits a format string vulnerability in HTTPDX FTP server (CVE-2009-4769) by sending a crafted FTP command to corrupt memory and execute arbitrary code. It supports multiple versions of HTTPDX and uses an egghunter for payload delivery.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: HTTPDX FTP server (versions 1.4, 1.4.5, 1.4.6, 1.4.6b, 1.5)
Auth required
Prerequisites: Network access to the FTP service (port 21) · Valid credentials (default: moderator/pass123)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC GREAT
by jduck · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/httpdx_tolog_format.rb

This Metasploit module exploits a format string vulnerability in HTTPDX HTTP server (CVE-2009-4769) by sending crafted HTTP requests with format specifiers to corrupt memory and execute arbitrary code. It uses an egghunter to locate and execute the payload in memory.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: HTTPDX HTTP server versions 1.4 to 1.5
No auth needed
Prerequisites: Network access to the HTTPDX server · Logging enabled for the 'moderator' user via FTP
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC GREAT
by jduck · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/ftp/httpdx_tolog_format.rb

This Metasploit module exploits a format string vulnerability in HTTPDX FTP server (CVE-2009-4769) by sending crafted FTP commands to corrupt memory and execute arbitrary code. It uses an egghunter and format string manipulation to achieve remote code execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: HTTPDX FTP server versions 1.4, 1.4.5, 1.4.6, 1.4.6b, 1.5
Auth required
Prerequisites: Network access to the FTP server · Valid credentials for the 'moderator' user
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5

Scores

EPSS 0.3790
EPSS Percentile 98.4%

Details

CWE
CWE-134
Status published
Products (5)
jasper/httpdx 1.4
jasper/httpdx 1.4.5
jasper/httpdx 1.4.6
jasper/httpdx 1.4.6b
jasper/httpdx 1.5
Published Apr 20, 2010
Tracked Since Feb 18, 2026