Vulnerability details
CVE-2025-47812
Actively exploited
Wftpserver Wing FTP Server
CVSS 3.1
10.0Critical
Remedy
Required action (CISA): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (due: 2025-08-04)
Versions not listed as affected in the CVE record:
- Wing FTP Server — version 7.4.4 and later
Official description
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 10.0Critical | 3.1 | CVEProject cvelistV5 (CNA) (mitre) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Wftpserver | Wing FTP Server | v < 7.4.4 | CVEProject cvelistV5 (CNA) |
References and advisories
6- https://www.wftpserver.com
- https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/
- https://www.vicarius.io/vsociety/posts/cve-2025-47812-mitigation-script-remote-code-execution-vulnerability-in-wing-ftp-server
- https://www.vicarius.io/vsociety/posts/cve-2025-47812-detection-script-remote-code-execution-vulnerability-in-wing-ftp-server
- https://www.huntress.com/blog/wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47812 government-resource
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-07-10
- Last updated
- 2026-02-26
- State
- Published
- Assigner (CNA)
- mitre
- Kolun priority
- 80 · Critical
CISA KEV catalog
- Date added
- 2025-07-14
- Due date
- 2025-08-04
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
93.88%
Probability of exploitation in 30 days
99.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-158Improper Neutralization of Null Byte or NUL Character