In Wing FTP Server before 7.4.4.
Wing FTP Server versions before 7.4.4 are affected when the web interface is enabled and an anonymous account is enabled. The fix is in 7.4.4. CVSS rates it critical at 10.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 7.4.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Wing FTP Server, a file transfer server product, is affected by a flaw in its user and admin web interfaces that lets attackers inject malicious code into session files. Successful exploitation allows remote execution of arbitrary system commands with the privileges of the FTP service, typically root or SYSTEM, which can lead to full compromise of the server.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- wftpserver Wing FTP Server
fixed in 7.4.4
References 4
wftpserver.com
rcesecurity.com
Questions about CVE-2025-47812
What does this mean?
The bug lets a remote attacker run code on the server with the privileges of the FTP service, which is root on Linux and SYSTEM on Windows by default. The advisory describes going from an anonymous read-only account to full code execution as root.Source: rcesecurity.com
Am I affected, and how do I check?
Wing FTP Server versions before 7.4.4 are in scope. The bug needs the user or admin web interface to be enabled and reachable, and an anonymous account to be enabled on the server (a valid user account can also be used). To check, look at the server version in the admin interface and review whether the anonymous account is enabled and the web interface is reachable.Source: rcesecurity.com
What should I do about it?
Upgrade Wing FTP Server to version 7.4.4 or later.Source: rcesecurity.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-07-14, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data