CVE-2025-27889
Published: 10 July 2025
Summary
CVE-2025-27889 is a low-severity External Control of System or Configuration Setting (CWE-15) vulnerability in Wftpserver Wing Ftp Server. Its CVSS base score is 3.4 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
The policy and procedures establish internal controls and change management for system configuration settings, reducing the feasibility of external unauthorized modifications.
Baseline configuration under change control directly prevents unauthorized external modification of system or configuration settings.
Requires approval, documentation, and security impact review of all configuration changes, directly preventing unauthorized external control of system settings.
Impact analysis of configuration changes reduces the risk of deploying settings that permit unauthorized external control.
Restricting changes to system and configuration settings prevents external entities from controlling those settings without approval.
Establishing, implementing, approving deviations from, and monitoring configuration settings directly prevents external or unauthorized control of system settings.
The plan defines processes for identifying and managing configuration items, preventing external unauthorized control of system settings.
Vulnerability scanners directly detect externally controllable or misconfigured settings using standardized checklists.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2025-27889 allows arbitrary link injection in a public-facing FTP server web endpoint, facilitating exploitation for credential access via cleartext password disclosure (T1212). The advisory details CVE-2025-47812, enabling pre-auth RCE via NULL byte authentication bypass in the same public-facing application (T1190).
NVD Description
Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link, this discloses a cleartext password to the attacker.
Deeper analysisAI
CVE-2025-27889 affects Wing FTP Server versions prior to 7.4.4, stemming from improper validation and sanitization of the "url" parameter in the downloadpass.html endpoint (CWE-15). This flaw enables attackers to inject arbitrary links into responses. The vulnerability carries a CVSS v3.1 base score of 3.4 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N), rated as low severity due to its reliance on user interaction and limited impact scope.
Exploitation requires no privileges and can occur over the network, but demands high attacker effort and user interaction. An attacker crafts a malicious link targeting the vulnerable endpoint and tricks a legitimate user—such as an administrator—into clicking it. Successful interaction results in the disclosure of a cleartext password to the attacker, potentially enabling further unauthorized access to FTP resources or accounts.
Advisories, including the vendor's site at wftpserver.com and a detailed GitHub advisory, recommend upgrading to Wing FTP Server 7.4.4 or later to mitigate the issue by addressing the parameter validation flaw. No workarounds are specified in available references.
Details
- CWE(s)