Remote code execution via oversized SYSTEM command

Buffer overflow in PCMan FTP Server 2.0.7 allows remote attackers to execute arbitrary code through an oversized FTP SYSTEM command. The SYSTEM command handler copies more than 2,004 bytes of command data into a fixed-size buffer, allowing the supplied bytes to overwrite the instruction pointer and redirect execution to an x86 Windows payload. The published exploit authenticates with anonymous FTP credentials before sending the command, so exposure requires a reachable FTP service that permits anonymous login; successful exploitation grants code execution in the server process.