Critical severity · published Jul 10, 2025
CVE-2025-47812
Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
In wildKEV
10.0
CVSS
93.9%
EPSS
Yes
On KEV
Description
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)93.9% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Jul 14, 2025
Federal remediation dueAug 4, 2025
Ransomware campaign useNot known
Affected products
Which versions
WF
Wing FTP Server · wftpserver
before 7.4.4 · source: vendor, NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-47812
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-47812
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
www.wftpserver.com
https://www.wftpserver.com
www.rcesecurity.com
https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/
www.vicarius.io
https://www.vicarius.io/vsociety/posts/cve-2025-47812-mitigation-script-remote-code-execution-vulnerability-in-wing-ftp-server
www.vicarius.io
https://www.vicarius.io/vsociety/posts/cve-2025-47812-detection-script-remote-code-execution-vulnerability-in-wing-ftp-server
More from Wing FTP Server
4.3
CVE-2025-47813
Wing FTP Server Information Disclosure Vulnerability
8.8
CVE-2020-37032
Wing FTP Server 6.3.8 - Remote Code Execution
8.8
CVE-2025-27889
Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link
8.8
CVE-2023-37881
Weak access control in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0
8.8
CVE-2023-37878
Insecure default permissions in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0