CVE-2017-17405

CVE-2017-17405 is a critical command injection vulnerability affecting Ruby versions prior to 2.4.3, specifically within the Net::FTP library. Malicious FTP servers can exploit this by manipulating the localfile argument in Net::FTP operations, leading to arbitrary command execution on the client system. With a CVSS score of 8.8 (High) and an EPSS score indicating high exploitability, this vulnerability poses a significant risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While not listed on the KEV catalog or Hot List, public exploit code exists (EDB-43381), though there is no evidence of active exploitation or significant community discussion.