CVE-2017-6465: FTPShell Client PWD response buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCritical CVSS 9.8 with public exploit code and very high EPSS, but no KEV listing and the flaw is in a legacy client, so it is high rather than critical for most environments.

What it is

FTPShell Client 6.53 sends a PWD command on connect and does not validate the length of the server's response, causing a stack buffer overflow (CWE-119). A malicious or compromised FTP server can therefore execute code on the connecting client, which matters because the client is the victim and the trigger is routine connection behavior.

Impact

An attacker controlling the FTP server gains remote code execution in the context of the FTPShell Client process on the victim's machine. That allows arbitrary code, data theft or further host compromise without any action by the user beyond connecting.

Attack surface

Reached over the network via the FTP protocol: the client connects to an attacker-controlled or compromised FTP server, which returns an oversized PWD response. No authentication to the client is required and no user interaction beyond initiating the connection; CVSS vector is AV:N/AC:L/PR:N/UI:N.

Exploitation

Public exploit code exists (Exploit-DB 41511 and Packet Storm advisory), and EPSS is 0.503 (98.9th percentile), indicating high likelihood of exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild use is recorded here.

What to do

• Upgrade FTPShell Client to a version later than 6.53 if the vendor has released a fix; the record does not name a fixed version, so verify with the vendor.
• If no patch is available, stop using FTPShell Client 6.53 and replace it with a maintained FTP client.
• Restrict client connections to trusted, known FTP servers and block outbound FTP to untrusted hosts at the perimeter.
• Where FTPShell must remain, isolate it in a low-privilege environment and monitor for crashes or unexpected child processes.

Detection

• Monitor FTPShell Client for crash events or access violations on connect, which may indicate an oversized PWD response.
• Alert on outbound FTP connections from hosts running FTPShell Client to servers outside an approved allowlist.
• Hunt for unexpected child processes or network connections spawned by the FTPShell Client process.
• Review proxy or firewall logs for FTP sessions to newly seen or untrusted server addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.