FTP Shell Server 6.83 includes a buffer overflow in the 'Account name to ban' field that lets a local attacker supply a crafted string and overwrite the return address. The attacker can inject shellcode and execute arbitrary commands, such as launching calc.exe or other programs, thereby gaining control over the application process with the privileges of the FTP Shell Server service.

The vulnerability affects Ftpshell's FTP Shell Server product, version 6.83. No other versions or vendors are listed in the CNA data.

The CVSS score of 8.6 classifies the issue as high severity, but the EPSS score indicates a very low probability of exploitation via the public internet. Because the flaw requires local access to the Manage FTP Accounts dialog, the attack vector is likely local. The vulnerability is not listed in the CISA KEV catalog. An attacker with local system access can execute arbitrary code, potentially compromising the entire host.