In CISA KEV10.0 CriticalCWE-158
CVE-2025-47812
Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
Status
- Exploited in the wild
- In CISA KEV since 14 Jul 2025
Federal deadlineMon 4 Aug 2025, 23:59 UTC
Passed 446 days ago
CISA KEV · added 14 Jul 2025
Exploit probabilityEPSSchecked 23 Oct
94%probability of exploitation in the next 30 days
Higher than 100% of scored CVEs
SeverityCVSS
10.0Critical
Description NVD
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 2 articles · 2 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 17 Mar · 06:01 UTC | The Hacker News | CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths |
| Tue 17 Mar · 11:07 UTC | SecurityWeek | CISA Flags Year-Old Wing FTP Vulnerability as Exploited |
- CISA Flags Year-Old Wing FTP Vulnerability as ExploitedSecurityWeek · mentions it in passing
- CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server PathsThe Hacker News · first in our coverage · mentions it in passing