CVE-2006-4847: Ipswitch WS_FTP Server buffer overflows in XCRC, XSHA1, XMD5 commands

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote authenticated code execution with a very high EPSS score, though exploitation requires valid credentials and no KEV listing exists.

What it is

Ipswitch WS_FTP Server 5.05 before Hotfix 1 contains multiple buffer overflows reachable through long XCRC, XSHA1, or XMD5 commands. A remote authenticated user can trigger the overflows and execute arbitrary code on the server. The flaw matters because it lets a low-privilege FTP account escalate to code execution on the host.

Impact

An attacker with valid FTP credentials gains arbitrary code execution with the privileges of the WS_FTP Server process, potentially leading to full host compromise.

Attack surface

Reached over the network via the FTP service by sending oversized XCRC, XSHA1, or XMD5 commands. Authentication is required (Au:S in the CVSS vector); no user interaction is indicated.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is very high (0.85254, 99.7th percentile), suggesting elevated likelihood of exploitation activity.

What to do

• Apply Ipswitch WS_FTP Server 5.05 Hotfix 1 (or later) per the vendor advisory.
• If patching is delayed, restrict FTP access to trusted networks and disable or block the XCRC, XSHA1, and XMD5 commands where possible.
• Enforce strong unique credentials and least privilege for FTP accounts to limit who can reach the vulnerable commands.
• Monitor vendor advisories for the affected product line and plan migration off end-of-life versions.

Detection

• Alert on FTP command logs containing unusually long XCRC, XSHA1, or XMD5 arguments.
• Monitor WS_FTP Server process for crashes or unexpected child processes indicating exploitation attempts.
• Baseline normal FTP command lengths and flag outliers from authenticated sessions.
• Correlate FTP authentication events with subsequent suspicious process creation on the server host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.