Buffer Overflow in the FTP client in LabF nfsAxe 3.7 allows remote FTP servers to execute arbitrary code via a long reply.

1. 2017-05-15 First public exploit (Metasploit exploit/windows/ftp/labf_nfsaxe)
2. 2018-01-22 Published

19.73% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

• Metasploit exploit/windows/ftp/labf_nfsaxe LabF nfsAxe 3.7 FTP Client Stack Buffer Overflow metasploit exploit, normal rank, 2017-05-15
• exploit-db.com https://www.exploit-db.com/exploits/43236/ referenced PoC, tagged "exploit" by a source, unverified
• exploit-db.com https://www.exploit-db.com/exploits/43518/ referenced PoC, tagged "exploit" by a source, unverified
• exploit-db.com https://www.exploit-db.com/exploits/42011/ referenced PoC, tagged "exploit" by a source, unverified

Weakness

• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

• exploit-db.com /exploits/43236/

  exploit, third-party-advisory, vdb-entry

• exploit-db.com /exploits/43518/

  exploit, third-party-advisory, vdb-entry

• exploit-db.com /exploits/42011/

  exploit, third-party-advisory, vdb-entry

• CVE List CVE-2017-18047
• NVD CVE-2017-18047

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.