CVE-2025-47812
Critical 10.0 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.
Metrics
- CVSS 3.1
-
10.0 (CRITICAL)
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - EPSS — exploit probability
- 94% (percentile: 100) as of 1 November 2026
- CWE
- CWE-158
Affected products
wftpserver: wing ftp server
References
- https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-… ExploitThird Party Advisory
- https://www.huntress.com/blog/wing-ftp-server-remote-code-execution-cve-2025-47… ExploitThird Party Advisory
- https://www.vicarius.io/vsociety/posts/cve-2025-47812-detection-script-remote-c… Third Party Advisory
- https://www.vicarius.io/vsociety/posts/cve-2025-47812-mitigation-script-remote-… MitigationThird Party Advisory
- https://www.wftpserver.com Product
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025… US Government Resource