PT-2025-27480 · Wing Ftp · Wing Ftp Server

Julien Ahrens · Published 2025-05-10 · Updated 2026-04-03 · CVE-2025-47812

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wing FTP Server versions prior to 7.4.4

Description Wing FTP Server is affected by a critical remote code execution (RCE) vulnerability (CVE-2025-47812) stemming from improper handling of null bytes ('0') in the web interfaces. This allows attackers to inject arbitrary Lua code into user session files, potentially executing arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). The vulnerability is exploitable even with anonymous FTP accounts. Active exploitation of this flaw has been observed, with attackers attempting to gain root/SYSTEM access, scan systems, and install malware. Over 8,100 systems are estimated to be exposed, including those belonging to the U.S. Air Force and Airbus. The vulnerability allows for unauthenticated remote code execution. The loginok.html endpoint is a target for exploitation.

Recommendations Update Wing FTP Server to version 7.4.4 or later.

Exploit

Fix

RCE

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

CWE-158

Related Identifiers

BDU:2025-08471

BDU:2025-08716

CVE-2025-47812

Affected Products

Wing Ftp Server

References · 244

• 🔥 https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt · Exploit
• 🔥 https://github.com/4m3rr0r/CVE-2025-47812-poc · Exploit
• 🔥 https://rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812 · Exploit
• 🔥 https://exploit-db.com/exploits/52347 · Exploit
• 🔥 https://huntress.com/blog/wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild · Exploit
• https://wftpserver.com/serverhistory.htm · Security Note
• https://osv.dev/vulnerability/CVE-2025-47812 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47812 · Security Note
• https://bdu.fstec.ru/vul/2025-08471 · Security Note
• https://bdu.fstec.ru/vul/2025-08716 · Security Note
• https://github.com/MrTuxracer/advisories · Note
• https://vicarius.io/vsociety/posts/cve-2025-47812-detection-script-remote-code-execution-vulnerability-in-wing-ftp-server · Note
• https://t.me/pentestingnews/64472 · Telegram Post
• https://twitter.com/miguelcarvajalm/status/1943775124177481804 · Twitter Post
• https://twitter.com/FireCompass/status/1947408745153098060 · Twitter Post