WFTPD server versions 3.1 through 3.21 and Pro server versions 3.2x have a stack based buffer overflow vulnerability that a remote attacker can exploit to execute arbitrary code. The daemon runs with SYSTEM privileges under Pro server releases and it runs under the user ID that spawn the process under regular server releases.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/32789/wftpdBO.txt
Source: https://packetstormsecurity.com/files/32789/wftpdBO.txt.html