CVE-2025-47812
Published: 10 July 2025
Summary
CVE-2025-47812 is a critical-severity Improper Neutralization of Null Byte or NUL Character (CWE-158) vulnerability in Wftpserver Wing Ftp Server. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of the specific flaw in Wing FTP Server by patching to version 7.4.4 or later, directly eliminating the null byte mishandling leading to RCE.
Enforces validation of information inputs to web and FTP interfaces, preventing injection of arbitrary Lua code via mishandled '\0' bytes.
Limits the impact of successful RCE by ensuring the FTP service runs with least privilege instead of root or SYSTEM.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated RCE on public-facing FTP/web interface via Lua code injection into session files, enabling arbitrary command execution as root/SYSTEM.
NVD Description
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the…
more
FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.
Deeper analysisAI
CVE-2025-47812 is a remote code execution vulnerability affecting Wing FTP Server versions before 7.4.4. The user and admin web interfaces mishandle null bytes ('\0'), enabling attackers to inject arbitrary Lua code into user session files. This flaw, tied to CWE-158 (Unicode Encoding Error), allows execution of arbitrary system commands with the privileges of the FTP service, which runs as root or SYSTEM by default, guaranteeing total server compromise.
Attackers require no authentication and can exploit the vulnerability remotely over the network with low complexity, as reflected in its perfect CVSS v3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Exploitation is possible even via anonymous FTP accounts, allowing unauthenticated remote actors to achieve full control, including data theft, modification, or deletion, and potential lateral movement within the environment.
Vendor advisories on wftpserver.com recommend upgrading to version 7.4.4 or later to mitigate the issue. Vicarius provides detection and mitigation scripts for identifying vulnerable installations and applying workarounds. The vulnerability appears in CISA's Known Exploited Vulnerabilities Catalog, underscoring the need for immediate patching.
Its presence in CISA's KEV catalog indicates real-world exploitation is occurring or imminent, urging security practitioners to prioritize scanning and remediation for exposed Wing FTP Server instances.
Details
- CWE(s)
- KEV Date Added
- 14 July 2025