Critical Vulnerability in Wing FTP Server Exposed: What You Need to Know
Overview of the Vulnerability
A severe security flaw affecting the Wing FTP Server has recently been revealed, capturing the attention of cybersecurity experts. This vulnerability, designated as CVE-2025-47812, has been rated with the highest severity score of 10.0 on the Common Vulnerability Scoring System (CVSS). As identified by the cybersecurity firm Huntress, this flaw arises from improper handling of null (‘\0’) bytes in the server’s web interface. The situation is particularly alarming as threat actors are actively exploiting this vulnerability.
Details of the Flaw
The root of the issue lies in how the user and admin interfaces manage null byte inputs, allowing for the injection of arbitrary Lua code into user session files. As a result, this vulnerability opens the door for an attacker to execute arbitrary system commands, typically running with the same privileges as the FTP service, which are often root or SYSTEM by default. The vulnerability has been addressed in version 7.4.4 of the Wing FTP Server.
Huntress elaborated on the specific mechanics of this flaw, noting, “The improper interpretation of null bytes in the username parameter, particularly linked to the loginok.html file, leads to a scenario where remote attackers can manipulate inputs.” This exploitation facilitates Lua code injection after using the null byte in an authentication request.
The Danger of Exploitation
What escalates the risk of this vulnerability is its potential to be exploited via anonymous FTP accounts. Early insights regarding this flaw were shared around the end of June 2025 by RCE Security researcher Julien Ahrens, leading to a concerning escalation in its active exploitation.
According to Huntress, they have observed certain threat actors using this vulnerability to download and execute harmful Lua files, engaging in reconnaissance activities, and installing unauthorized remote monitoring and management software. This can give attackers persistent access and significantly compromise system integrity.
Active Exploitation Reports
The exploitation of CVE-2025-47812 came to light on July 1, 2025, just a day after the vulnerability details were publicly uncovered. During this initial breach, threat actors managed to infiltrate a specific customer’s server, running enumeration and reconnaissance commands. They established persistence by creating new user accounts and attempted to drop malicious Lua files that would install remote desktop tools such as ScreenConnect.
Fortunately, the attack was detected promptly, preventing the further advancement of this potential compromise. However, the identity of the threat actors remains unclear.
Scope and Reach of the Vulnerability
Data from Censys reveals that over 8,100 devices running the Wing FTP Server are accessible via the internet, with about 5,004 of these having their web interfaces exposed. A significant number of these are located in the United States, China, Germany, the United Kingdom, and India. This wide exposure makes the potential for exploitation alarming.
Immediate Action Required
In light of these findings, it is crucial for users of the Wing FTP Server to act swiftly. Patching their systems and upgrading to version 7.4.4 or later is strongly advised to mitigate risks. Cybersecurity experts emphasize the importance of maintaining updated software to guard against such vulnerabilities, especially when active exploitation is underway.
By addressing these issues promptly, organizations can significantly reduce their vulnerability to attacks linked to CVE-2025-47812.
