High severity · published Mar 7, 2020
CVE-2020-8635
Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files
7.8
CVSS
0.8%
EPSS
No
On KEV
Description
Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. This allows local users to arbitrarily create FTP users with full privileges, and escalate privileges within the operating system by modifying system files.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
Wing Ftp Server · Wftpserver
6.2.3; 6.2.3; 6.2.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8635
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8635
Exploit
https://www.hooperlabs.xyz/disclosures/cve-2020-8635.php
More from Wing Ftp Server
10.0
CVE-2025-47812
Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
4.3
CVE-2025-47813
Wing FTP Server Information Disclosure Vulnerability
8.8
CVE-2020-37032
Wing FTP Server 6.3.8 - Remote Code Execution
8.8
CVE-2025-27889
Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link
8.8
CVE-2023-37881
Weak access control in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0