SmartFTP Client 10.0.2909.0 contains multiple denial of service vulnerabilities that enable an attacker to force application crashes through specific input manipulation.

The software suffers from resource allocation issues (CWE-770) where improper handling of malformed path inputs, invalid IP addresses, or connection history clearing allows an unauthenticated, locally-present attacker to trigger a crash.

While the CVSS score of 7.5 reflects a high severity rating, the primary impact is limited to local denial of service, which disrupts workflow and decreases productivity for users relying on the client. Although the risk to data confidentiality or integrity is minimal, the instability of critical file transfer tools can cause significant operational delays in environments where automated or manual file synchronization is essential.

Immediate Action: Users should update to the latest available version of SmartFTP Client provided by the vendor to ensure these stability issues are addressed.

Proactive Monitoring: Security teams should monitor system logs for frequent application crash events associated with the SmartFTP process.

Compensating Controls: Restrict local system access to authorized personnel only to prevent unauthorized users from interacting with the client interface.

Public Exploit Available: Yes, a proof of concept exists on Exploit-DB (EDB-ID: 50266).

Given the availability of a public proof-of-concept, organizations should prioritize updating SmartFTP Client to the latest version to prevent potential service disruptions. Users who cannot update immediately should exercise caution when inputting connection parameters or clearing history until a patch is applied.