A local stack-based buffer overflow in FTP Commander Pro 8 allows an attacker to execute arbitrary code by supplying a maliciously crafted command.

This is a stack-based buffer overflow (CWE-121) occurring in the Custom Command function of the application. An attacker with local access can trigger the flaw by providing a specially crafted input string of 4108 bytes, which overwrites the EIP register and enables arbitrary code execution.

Successful exploitation of this vulnerability allows a local attacker to execute arbitrary code with the privileges of the user running the application. This could lead to full system compromise, unauthorized data access, or the deployment of malicious software on the affected workstation. Given the CVSS score of 8.4, this vulnerability represents a high risk to organizational assets.

Immediate Action: Since no official patch is currently available, users should restrict access to the application and monitor for suspicious activity. If the software is not mission-critical, consider uninstalling it until the vendor provides a security update.

Proactive Monitoring: Review system logs for application crashes or unauthorized attempts to execute shellcode or unexpected processes initiated by the FTP Commander executable.

Compensating Controls: Ensure that the principle of least privilege is applied to all user accounts to minimize the potential impact if the application is compromised.

Public Exploit Available: Yes, a published proof-of-concept exploit exists via Exploit-DB (EDB-ID 47775 and 37810).

The presence of a functional proof-of-concept exploit elevates the risk of this vulnerability. Because no official patch is available, organizations should prioritize limiting the use of this software to authorized, low-privilege users and monitoring for anomalous application behavior. If the application is not required for business operations, removal is the most effective mitigation strategy.