A denial of service vulnerability in Fetch FTP Client 5.8.2 allows unauthenticated attackers to crash the application or cause 100 percent CPU utilization via malicious server responses.

The application suffers from an improper resource allocation vulnerability (CWE-770) where it fails to throttle or limit the processing of incoming FTP server responses. An unauthenticated attacker can supply a specially crafted response exceeding 2K bytes to force the client into a resource-exhaustion state.

Successful exploitation results in a denial of service, rendering the file transfer client unresponsive and consuming all available CPU resources on the host machine. Given the CVSS score of 7.5, this high-severity flaw poses a significant operational risk to organizations relying on this software for critical file transfers, potentially leading to productivity loss and service disruption.

Immediate Action: Users should update to the latest available version of Fetch FTP Client, as version 5.8.2 is confirmed as vulnerable. If an update is not immediately available, restrict connections to trusted FTP servers only to prevent exposure to malicious responses.

Proactive Monitoring: Security teams should monitor endpoint CPU usage patterns for anomalous spikes associated with the Fetch FTP process. Reviewing application logs for unusually large or malformed server responses may also assist in identifying attempted exploitation.

Compensating Controls: While a network-based WAF cannot inspect encrypted SFTP traffic, egress filtering on the local workstation can help ensure that the client only communicates with known, reputable server infrastructure.

Public Exploit Available: Yes, a proof-of-concept Python script is available via ExploitDB (EDB-ID 50696).

This vulnerability represents a significant risk to system stability for users of Fetch FTP Client. Organizations should prioritize patching or restricting the use of this software to secure environments immediately. Failure to address this flaw leaves systems susceptible to simple, high-impact denial of service attacks that can disrupt essential business workflows.