CVE-2018-25366
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A buffer overflow vulnerability in CuteFTP 5.0 XP allows local attackers to inject a malicious payload into the Site Manager label field, which overwrites the return address and executes shellcode when a shortcut is created and launched.
Risk Assessment
An attacker with local access could take control of the application and system, executing arbitrary code.
Recommendation
Update CuteFTP to a newer version or use alternative FTP software.
Other vulnerabilities in CuteFTP
Original NVD description (English source)
CuteFTP 5.0 XP contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by injecting malicious payload into the Site Manager label field. Attackers can craft a payload exceeding 520 bytes that overwrites the return address and executes shellcode when a shortcut is created and launched.