PT-2026-2410 · Unknown · Wing Ftp Server

Notcos · Publicado 2026-01-13 · Atualizado 2026-01-14 · CVE-2022-50934

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wing FTP Server versions 4.3.8 and below

Description The software contains a remote code execution issue that allows attackers to execute arbitrary PowerShell commands. An attacker can leverage a crafted Lua script payload with base64-encoded PowerShell to establish a reverse TCP shell. This is achieved by authenticating and sending a malicious request to the admin panel. The affected API endpoint is the admin interface. The vulnerable parameter is the request sent to the admin panel containing the Lua script payload.

Recommendations Update Wing FTP Server to a version newer than 4.3.8.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2022-50934

Produtos afetados

Wing Ftp Server

Referências · 5

• 🔥 https://exploit-db.com/exploits/50720 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-50934 · Nota de Segurança
• https://twitter.com/CVEnew/status/2011383052451099056 · Publicação no Twitter
• https://vulncheck.com/advisories/wing-ftp-server-authenticated-rce · Nota
• https://wftpserver.com · Nota