CVE-2025-47812
Wftpserver Wing Ftp Server ≤ 7.4.4
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2025-47812 is a critical-severity Improper Neutralization of Null Byte or NUL Character (CWE-158) vulnerability in Wftpserver Wing Ftp Server. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-47812 affects Wing FTP Server versions prior to 7.4.4. The user and admin web interfaces fail to properly handle null bytes, permitting injection of arbitrary Lua code into user session files. Successful exploitation yields remote code execution that runs with the privileges of the FTP service, which defaults to root on Unix-like systems or SYSTEM on Windows, enabling full server compromise.
The flaw is remotely exploitable over the network without authentication or user interaction, including through anonymous FTP accounts. An attacker can therefore achieve arbitrary system command execution and total control of the affected server.
Public references include a detailed technical analysis at rcesecurity.com, detection and mitigation scripts published by vicarius, the vendor site at wftpserver.com, and an entry in the CISA Known Exploited Vulnerabilities catalog confirming active exploitation in the wild. Upgrading to version 7.4.4 or later is the primary remediation path referenced.
The EPSS score has remained consistently high, with a current value of 0.9293 and a peak of 0.9311.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21009
Vulnerability Data
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the…
more
FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.
- CWE(s)
- KEV Date Added
- 14 July 2025
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.10
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly requires neutralizing or rejecting malformed characters such as NUL before they reach downstream components.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and validation to prevent null-byte flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect null-byte flaws but does not itself implement the neutralization.
Secure development lifecycle mandates input validation and sanitization that directly prevents null-byte injection.
Application security requirements include explicit rules for neutralizing dangerous characters such as NUL.
Secure architecture principles reduce the likelihood of unsafe data flows but do not prescribe character neutralization.
Secure coding standards explicitly require proper neutralization of null bytes and other metacharacters.