Critical Wing FTP Server Vulnerability (CVE-2025-47812) Actively Being Exploited in the Wild
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-47812 | Unauthenticated RCE in Wing FTP Server via null-byte Lua injection Wing FTP Server versions before 7.4.4 mishandle NUL ('\0') bytes in the user and admin web interfaces, allowing attackers to inject arbitrary Lua code into user session files (CWE-158). When the crafted session file is loaded, the injected Lua runs, giving an unauthenticated attacker execution of arbitrary system commands with the privileges of the FTP service — root on Linux or SYSTEM on Windows by default — which means a total server compromise. The flaw is exploitable without credentials, including through anonymous FTP accounts, so any organization running Wing FTP Server is affected, particularly those exposing its FTP or web interfaces to the internet. Exploitation is confirmed in the wild shortly after technical details and public proof-of-concept write-ups were published; CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-07-14, and EPSS assigns a ~93% probability of exploitation within 30 days. Do: Upgrade to Wing FTP Server 7.4.4 or later immediately, as it is the only fixed version named in the advisory; as interim mitigation, disable anonymous FTP access and restrict the user/admin web interfaces from the internet. Hunt for signs of compromise — unexpected Lua content in user session files, commands run by the FTP service account, or newly spawned processes or webshells — because the service runs as root/SYSTEM by default and any successful exploitation implies full server control. Federal agencies must apply vendor mitigations per BOD 22-01 guidance or discontinue use of the product per the KEV listing. | 10.0 | 93% | KEV PoC ×2 |
| moderate≈ several thousand internet-exposed Wing FTP Server instances (estimate; total installed base likely tens of thousands) |
Full article470 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJul 11, 2025Cyber Attack / Vulnerability
A recently disclosed maximum-severity security flaw impacting the Wing FTP Server has come under active exploitation in the wild, according to Huntress.
The vulnerability, tracked as CVE-2025-47812 (CVSS score: 10.0), is a case of improper handling of null ('\0') bytes in the server's web interface, which allows for remote code execution. It has been addressed in version 7.4.4.
"The user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files," according to an advisory for the flaw on CVE.org. "This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default)."
What makes it even more concerning is that the flaw can be exploited via anonymous FTP accounts. A comprehensive breakdown of the vulnerability entered the public domain towards the end of June 2025, courtesy of RCE Security researcher Julien Ahrens.
Cybersecurity company Huntress said it observed threat actors exploiting the flaw to download and execute malicious Lua files, conduct reconnaissance, and install remote monitoring and management software.
"CVE-2025-47812 stems from how null bytes are handled in the username parameter (specifically related to the loginok.html file, which handles the authentication process)," Huntress researchers said. "This can allow remote attackers to perform Lua injection after using the null byte in the username parameter."
"By taking advantage of the null-byte injection, the adversary disrupts the anticipated input in the Lua file which stores these session characteristics."
Evidence of active exploitation was first observed against a single customer on July 1, 2025, merely a day after details of the exploit were disclosed. Upon gaining access, the threat actors are said to have run enumeration and reconnaissance commands, created new users as a form of persistence, and dropped Lua files to drop an installer for ScreenConnect.
There is no evidence that the remote desktop software was actually installed, as the attack was detected and stopped before it could progress any further. It's currently not clear who is behind the activity.
Data from Censys shows that there are 8,103 publicly-accessible devices running Wing FTP Server, out of which 5,004 have their web interface exposed. The majority of the instances are located in the U.S., China, Germany, the U.K., and India.
In light of active exploitation, it's essential that users move quickly to apply the latest patches and update their Wing FTP Server versions of 7.4.4 or later.
Update
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on July 14, 2025, added CVE-2025-47812 to its Known Exploited Vulnerabilities (KEV) Catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by August 4, 2025.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/07/critical-wing-ftp-server-vulnerability.html