CVE-2025-47812

This vulnerability is like a broken “input filter” in the web parts of Wing FTP Server. By sending special characters, an attacker can trick the server into placing and running their own Lua code, which then runs commands on the server as the FTP service user (often with very high privileges). In practice, this can mean an attacker fully controls the machine running your FTP service.

This matters if you run Wing FTP Server (any installation) that is older than 7.4.4. The issue is remotely accessible over the network and does not require authentication or user interaction, which means exposure can exist even if you think no one should be able to log in.

It is a risk when the vulnerable web interfaces are reachable from the network running the FTP server (including cases consistent with anonymous FTP/account scenarios mentioned in the report).

This is a RED issue because it is confirmed in the CISA KEV catalog and is remotely exploitable without authentication, meaning attackers can directly target exposed servers. The CISA remediation due date is 2025-08-04, so you should treat this as time-critical and move to patch or approved mitigations immediately.

Confirm exposure

1. Identify the exact Wing FTP Server version running on the server(s) that host FTP/SFTP services.
2. Determine whether the server’s Wing web interfaces (user/admin web) are reachable from the internet or otherwise reachable from untrusted networks.

Patch (preferred)

1. Upgrade Wing FTP Server to version 7.4.4 or later.
2. After upgrading, confirm the version is now 7.4.4+.
3. If multiple servers or instances exist (e.g., multiple environments), repeat the checks and upgrade them all.

Temporary mitigation (if patching is delayed)

1. Apply the vendor/workaround mitigations provided for CVE-2025-47812.
2. Follow the vendor instructions carefully and keep the workaround in place only until the upgrade to 7.4.4 is completed.
3. Re-check that the mitigation is active after changes (and ensure it doesn’t break intended service operations).

Timeline

• CISA KEV remediation due date: 2025-08-04.

What to monitor after remediation

• Look for unusual requests to Wing FTP Server web interfaces (especially requests containing unusual payload structure consistent with '\0' byte handling issues).
• Check server logs for signs of unexpected Lua execution, new processes launched by the FTP service, or other indicators of command execution.
• If you suspect compromise, isolate the server and start incident response immediately.

Severity is critical (rated as 10 in the provided scoring) and the impact is total compromise: the vulnerability can be used to execute arbitrary system commands with the privileges of the FTP service (typically root or SYSTEM by default). The weakness is improper handling of '\0' bytes in Wing FTP Server’s user and admin web interfaces, which allows injection of arbitrary Lua code into user session files. Once injected, the server runs attacker-controlled Lua code, resulting in remote code execution.

Exploitation status: listed in CISA KEV (added 2025-07-14) with a remediation due date of 2025-08-04, which strongly indicates real-world exploitability. A public proof-of-concept exists (GitHub), and exploitation is described as feasible without authentication and without user interaction; the report also indicates anonymous FTP account scenarios may be relevant.

KEV meaning here: CISA cataloging indicates the vulnerability meets criteria for known exploitation in real environments, so operational urgency should be treated as immediate rather than speculative.