A stack-based buffer overflow in FTP Navigator 8.03 allows for application denial of service, which can be triggered by a local attacker providing malicious input.

The application is susceptible to a stack-based buffer overflow (CWE-121) within the custom command input function. An attacker can overwrite the Structured Exception Handler (SEH) with a specially crafted string of characters to force an application crash.

Successful exploitation of this vulnerability results in a denial of service, rendering the FTP client unresponsive and crashing the process. While the CVSS score of 7.5 reflects a high severity regarding availability, the impact is primarily localized to the individual workstation or server where the software is installed. However, repeated service disruption can hinder business operations that rely on this specific file transfer utility.

Immediate Action: As no official vendor patch is currently available, users should restrict access to the application and avoid entering untrusted commands into the custom command interface.

Proactive Monitoring: Security teams should monitor endpoint logs for recurring application crashes or unexpected terminations associated with the FTP Navigator process.

Compensating Controls: Implement endpoint protection policies to restrict the execution of unauthorized or legacy software that lacks active vendor support and security maintenance.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the Exploit-DB entry 47794.

Given the lack of a vendor-provided patch, this software should be considered end-of-life or insecure for enterprise use. Organizations should transition to supported, actively maintained FTP clients to eliminate the risk posed by this and any future unpatched vulnerabilities.