PT-2025-27486 · Wing Ftp · Wing Ftp Server

Julien Ahrens · Published 2025-05-10 · Updated 2026-05-29 · CVE-2025-47813

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wing FTP Server versions prior to 7.4.4

Description Wing FTP Server contains an information disclosure issue in the loginok.html file. The vulnerability occurs when a long value is provided in the UID cookie. This allows a remote attacker to disclose the full local installation path of the application. This vulnerability is actively exploited in the wild and has been observed being chained with remote code execution exploits. Attackers have leveraged this vulnerability to download malicious Lua files and install Remote Monitoring and Management (RMM) tools. CISA has added this vulnerability, identified as CVE-2025-47813, to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch within a specified timeframe. The vulnerability is triggered by improper validation of the UID cookie value.

Recommendations Update Wing FTP Server to version 7.4.4 or later.

Exploit

Fix

LPE

RCE

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

BDU:2025-08716

CVE-2025-47813

Affected Products

Wing Ftp Server

References · 58

• 🔥 https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt · Exploit
• 🔥 https://rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812 · Exploit
• https://bdu.fstec.ru/vul/2025-08716 · Security Note
• https://osv.dev/vulnerability/CVE-2025-47813 · Vendor Advisory
• https://wftpserver.com/serverhistory.htm · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-47813 · Security Note
• https://twitter.com/TweetThreatNews/status/2033644495460339785 · Twitter Post
• https://twitter.com/IT_news_for_all/status/2033776727067963760 · Twitter Post
• https://twitter.com/Cyberdailybrief/status/2035906459360190602 · Twitter Post
• https://reddit.com/r/TechNadu/comments/1rw70lt/cisa_just_added_a_new_actively_exploited_vuln_to · Reddit Post
• https://twitter.com/aviatrixtrc/status/2033948871919886615 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1rvfpc4/cisa_warns_of_newly_exploited_vulnerability_in · Reddit Post
• https://twitter.com/vuln_tracker/status/2033715749311942836 · Twitter Post
• https://twitter.com/TheCyphere/status/2060255523350692312 · Twitter Post
• https://twitter.com/NewsNerdie/status/2033785864120074426 · Twitter Post