CVE-2018-7573: FTPShell Client 6.7 buffer overflow via FTP 220 response

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction, public exploit code, and very high EPSS make this a critical risk for any host still running FTPShell Client 6.7.

What it is

FTPShell Client 6.7 has a memory buffer overflow (CWE-119) when a remote FTP server sends 400 'F' characters alongside the FTP 220 response code. The overflow crashes the client and can be leveraged to execute arbitrary code on the victim machine. It is similar to CVE-2009-3364 and CVE-2017-6465.

Impact

An attacker can crash the FTPShell client and, after the overflow, run arbitrary code on the victim machine. This gives the attacker code execution in the context of the logged-in user.

Attack surface

Reached over the network when the client connects to a malicious or compromised FTP server that returns the crafted 220 response. No authentication or user interaction is required beyond the client initiating the FTP connection.

Exploitation

Public exploit code exists (Exploit-DB 44596 and 44968, plus a CXSecurity advisory), and EPSS is 0.69204 (99.3rd percentile), indicating high likelihood of exploitation. It is not listed in CISA KEV.

What to do

• Upgrade FTPShell Client to a version later than 6.7 if one is available; the record does not name a fixed version.
• If no fixed version exists, stop using FTPShell Client 6.7 and replace it with a maintained FTP client.
• Restrict outbound FTP connections to trusted, known servers and block arbitrary FTP endpoints at the network boundary.
• Treat FTP server responses as untrusted input and avoid connecting to servers outside approved infrastructure.

Detection

• Monitor for FTPShell Client 6.7 crashes and process terminations, especially around FTP session activity.
• Inspect network traffic for FTP 220 responses containing long runs of repeated characters such as 'F'.
• Alert on unexpected child processes or code execution originating from the FTPShell client process.
• Track outbound FTP connections to untrusted or newly seen servers from hosts running FTPShell Client.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.