CVE-2025-47812

What it actually does

Wing FTP Server versions before 7.4.4 mishandle NUL/null bytes in input processed by the user and administrator web interfaces. By placing crafted null-byte sequences in web requests, an attacker can cause arbitrary Lua code to be written into Wing FTP session files. When the server later processes those session files, the injected Lua can execute operating-system commands with the privileges of the Wing FTP service, which commonly runs as root on Linux/Unix or SYSTEM on Windows. The result is unauthenticated or low-authenticated remote code execution and full server compromise, including cases where anonymous FTP access is enabled.

Why it matters to the business

This vulnerability can allow an external attacker to take complete control of a file-transfer server, steal or modify transferred files, create backdoor accounts, pivot into connected systems, and disrupt business file-exchange operations. Because it has a CVSS score of 10.0, a very high EPSS likelihood, active exploitation in the wild, and is listed in CISA KEV with a remediation due date of 2025-08-04, exposed Wing FTP Server instances should be treated as urgent incident-response priorities rather than routine patching tasks.

How an attack unfolds

An attacker first identifies a Wing FTP Server instance exposing the web user or admin interface. They send a crafted request containing a null byte in an input field that is later incorporated into session state. Due to improper input validation, the server writes attacker-controlled Lua code into a session file. When Wing FTP loads or evaluates that session data, the Lua payload invokes command-execution functions such as os.execute or io.popen. The attacker then runs system commands as the Wing FTP service account, which is often root or SYSTEM by default. From there, they can upload web shells or tooling, add users, dump configuration and credentials, access hosted files, disable logging, establish persistence, and use the compromised server as a staging point for further intrusion. Exploitation can also be performed through anonymous FTP-enabled configurations, increasing risk for internet-facing deployments.

How to fix it

Upgrade Wing FTP Server to version 7.4.4 or later immediately. If the server is internet-facing, prioritize remediation ahead of routine maintenance windows due to active exploitation and KEV status. Until upgraded, restrict access to the user and admin web interfaces with firewall rules, VPN, or trusted management networks; disable anonymous FTP access where not strictly required; run the service under a dedicated least-privilege account instead of root or SYSTEM; and restrict outbound network access from the server. Because successful exploitation provides full server-level code execution, treat any vulnerable exposed instance as potentially compromised: preserve evidence, review logs and session files, rotate FTP/admin credentials and any secrets stored on the server, validate file integrity, and consider rebuilding from known-good media if compromise cannot be ruled out.

How to confirm the fix worked

Confirm the installed Wing FTP Server version is 7.4.4 or later through the product UI, binary metadata, package inventory, or vendor-supported version command. Verify that web user and admin interfaces are not exposed to untrusted networks unless required and protected. Confirm anonymous FTP is disabled unless explicitly needed. Review service configuration to ensure Wing FTP is not running as root or SYSTEM where avoidable. After patching, test that requests containing encoded null bytes such as %00 are rejected or safely handled and do not alter session files. Re-scan externally and internally to verify that no vulnerable instances remain.

Typical attack path

1. Scan the internet or internal address space for exposed Wing FTP Server web interfaces.
2. Fingerprint the server version or test for vulnerable null-byte handling behavior.
3. Submit a crafted web request containing encoded NUL/null-byte input and Lua payload content.
4. Cause the malicious Lua code to be written into a Wing FTP session file.
5. Trigger session processing so the injected Lua executes system commands.
6. Spawn a shell or download additional payloads using curl, wget, PowerShell, certutil, or similar tools.
7. Steal files, credentials, configuration data, and FTP account information.
8. Create persistence, add accounts, modify server configuration, or pivot to adjacent systems.

How to detect it

Review Wing FTP web access logs, admin/user interface logs, FTP authentication logs, application error logs, session files, and operating-system process creation telemetry from the period before and after patching. Look for HTTP requests containing encoded null bytes such as %00 or unusual escaped NUL representations, especially in login, username, password, session, or admin-related parameters. Inspect Wing FTP session files for unexpected Lua syntax or command-execution functions such as os.execute, io.popen, load, loadstring, require, or references to shell commands. On Windows, review Event ID 4688, Sysmon Event ID 1, EDR telemetry, and service logs for cmd.exe, powershell.exe, wscript.exe, certutil.exe, bitsadmin.exe, mshta.exe, or rundll32.exe spawned by the Wing FTP service process. On Linux/Unix, review auditd, syslog, shell history, and EDR telemetry for /bin/sh, bash, curl, wget, python, perl, nc, or chmod spawned by the Wing FTP service. Also look for new or modified FTP accounts, unexpected administrator accounts, altered server configuration, unusual outbound connections, newly dropped executables/scripts, archive creation, and large file-transfer activity following suspicious web requests. If evidence of exploitation is found, assume full host compromise and expand investigation to credentials, file repositories, and adjacent systems accessed from the server.

• %00
• \x00
• %5C0
• os.execute
• io.popen
• loadstring
• package.loadlib
• require("os")
• require('os')
• cmd.exe /c
• powershell.exe
• powershell -enc
• certutil.exe -urlcache
• bitsadmin /transfer
• mshta.exe
• rundll32.exe
• /bin/sh -c
• bash -c
• curl http
• wget http
• chmod +x
• nc -e
• ncat -e
• WFTPServer.exe
• Wing FTP Server

What your security team should do

• Immediately inventory all Wing FTP Server deployments and identify any versions earlier than 7.4.4.
• Patch or upgrade all affected servers to Wing FTP Server 7.4.4 or later, prioritizing internet-facing systems first.
• Treat exposed vulnerable servers as potentially compromised and initiate forensic review before assuming patching alone is sufficient.
• Disable anonymous FTP access unless there is a documented business requirement.
• Restrict web administration and user portals to trusted networks, VPNs, or allowlisted management IP ranges.
• Run the Wing FTP service with a dedicated least-privilege account and remove root/SYSTEM execution where operationally possible.
• Review Wing FTP session files, access logs, error logs, authentication logs, and OS process-creation logs for signs of Lua command execution or null-byte exploitation.
• Rotate Wing FTP administrator credentials, FTP user passwords, API keys, SSH keys, and other secrets stored on or accessible from the server.
• Add SIEM detections for encoded NUL bytes, suspicious Lua functions in session data, and command interpreters launched by the Wing FTP service process.
• Apply the CISA KEV urgency model and ensure remediation tracking reflects the 2025-08-04 due date.