CVE-2025-47812
Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
Description
CVE-2025-47812 is a critical remote code execution vulnerability in Wing FTP Server before version 7.4.4 that allows an unauthenticated attacker to achieve complete server compromise. The vulnerability exploits improper handling of null bytes in the user and admin web interfaces, enabling injection of arbitrary Lua code into user session files. This injected code executes with the privileges of the FTP service — root on Linux or SYSTEM on Windows by default — guaranteeing total server takeover. With the maximum CVSS v3.1 base score of 10.0 (Critical), even anonymous FTP accounts can exploit this flaw. CISA has added CVE-2025-47812 to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 4, 2025, and its EPSS score of 92.47% at the 99th percentile places it among the most exploited vulnerabilities in the current threat landscape.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| wftpserver | wing ftp server | < 7.4.4 |
References
- https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/(Exploit, Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-47812-detection-script-remote-code-execution-vulnerability-in-wing-ftp-server(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-47812-mitigation-script-remote-code-execution-vulnerability-in-wing-ftp-server(Mitigation, Third Party Advisory)
- https://www.wftpserver.com(Product)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47812(US Government Resource)
- https://www.huntress.com/blog/wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild(Exploit, Third Party Advisory)
Weakness Type
CWE-158: Improper Neutralization of Null Byte or NUL Character
CVE-2025-47812 is classified under CWE-158, which describes vulnerabilities where an application fails to properly handle null bytes (\0) in input data, leading to unexpected behavior in downstream processing. In Wing FTP Server, the web interfaces for both users and administrators mishandle null bytes, allowing an attacker to inject arbitrary Lua scripting code into user session files. Because Wing FTP Server uses Lua as its scripting engine and session files are interpreted as Lua code, the injected content is executed as server-side commands with the highest possible system privileges.
Learn more: CWE-158 — Improper Neutralization of Null Byte or NUL Character
Impact Analysis
CVE-2025-47812 achieves the maximum possible CVSS v3.1 base score of 10.0 (Critical), reflecting the most severe vulnerability characteristics across all dimensions. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requires no authentication (PR:N), and demands no user interaction (UI:N). The changed scope (S:C) means exploitation affects resources far beyond the Wing FTP Server application. All CIA dimensions face maximum impact: Confidentiality (High) grants access to all files on the server and any connected storage; Integrity (High) enables modification of any system file, installation of backdoors, and manipulation of transferred data; and Availability (High) allows complete service destruction. The fact that exploitation is possible through anonymous FTP accounts dramatically expands the attack surface. With an EPSS score of 92.47% at the 99th percentile, this vulnerability is among the most likely to be exploited of all tracked vulnerabilities, and the root/SYSTEM execution context guarantees maximum damage from any successful attack.
Exploit Maturity
CVE-2025-47812 demonstrates maximum exploit maturity with confirmed active exploitation in the wild. CISA has added this vulnerability to the KEV catalog, and detailed public exploit research is available from RCE Security, which provides a comprehensive technical writeup of the null byte injection technique. Additionally, Huntress has published detailed analysis confirming exploitation in the wild and providing indicators of compromise. The EPSS score of 92.47% at the 99th percentile is exceptionally high, indicating near-certain exploitation. The combination of maximum CVSS score, no authentication requirement, exploitability via anonymous FTP, and root/SYSTEM-level code execution makes this one of the most dangerous file transfer vulnerabilities currently being exploited.
Remediation
-
Upgrade Wing FTP Server to version 7.4.4 or later immediately. This update addresses the null byte handling vulnerability in both the user and admin web interfaces. Visit wftpserver.com for the latest release.
-
Disable anonymous FTP access. If anonymous FTP accounts are enabled, disable them immediately as they provide an unauthenticated exploitation path. Review all FTP user accounts and remove any that are unnecessary.
-
Restrict web interface access. Limit access to the Wing FTP Server user and admin web interfaces to trusted IP addresses only. Use firewall rules to block public access to the web management ports until the upgrade is complete.
-
Conduct forensic investigation. Given the root/SYSTEM execution context and confirmed exploitation in the wild, treat any unpatched Wing FTP Server instance as potentially compromised. Review session files for evidence of Lua code injection, check for unauthorized system modifications, look for persistence mechanisms such as cron jobs or scheduled tasks, and examine network connections for command-and-control activity. Consult Huntress's indicators of compromise.
-
Implement defense-in-depth for file transfer services. Run the Wing FTP Server process with the minimum necessary privileges instead of root/SYSTEM. Deploy network-level monitoring for outbound connections from the FTP server, and implement file integrity monitoring on the server to detect unauthorized modifications to session files and system configurations.
Technical Details
CVE-2025-47812 is a remote code execution vulnerability in Wing FTP Server with the CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The vulnerability exploits a null byte handling flaw in the user and admin web interfaces. Wing FTP Server uses Lua as its internal scripting engine and stores user session data in files that are later parsed and executed as Lua code. The web interfaces fail to properly sanitize null bytes (\0) in user-controlled input, which allows an attacker to terminate strings prematurely and inject arbitrary Lua code into session files. When the server subsequently processes these session files, it executes the injected Lua code with the privileges of the FTP service process, which by default runs as root on Linux or SYSTEM on Windows. The RCE Security research details the exact injection technique, demonstrating how a single crafted request containing null bytes followed by Lua code achieves reliable code execution. The attack is accessible even through anonymous FTP accounts, as the session file writing mechanism does not require elevated FTP privileges. Affected versions include all Wing FTP Server releases prior to 7.4.4.
Frequently Asked Questions
Is CVE-2025-47812 being actively exploited?
Yes. CISA has confirmed active exploitation, and Huntress has published detailed analysis of exploitation observed in the wild. The EPSS score of 92.47% at the 99th percentile makes this one of the most exploited vulnerabilities currently being tracked.
What products are affected by CVE-2025-47812?
Wing FTP Server versions prior to 7.4.4 are affected. Both the user and admin web interfaces contain the null byte handling vulnerability. The flaw is exploitable even through anonymous FTP accounts.
How do I fix CVE-2025-47812?
Upgrade Wing FTP Server to version 7.4.4 or later. Disable anonymous FTP access, restrict web interface access to trusted networks, and conduct a forensic investigation of any previously exposed instances. CISA mandates remediation by August 4, 2025.
How severe is CVE-2025-47812?
CVE-2025-47812 has the maximum CVSS v3.1 score of 10.0 (Critical). It enables unauthenticated remote code execution as root/SYSTEM through anonymous FTP, making it one of the most severe file transfer vulnerabilities ever disclosed. The 99th percentile EPSS ranking confirms near-certain exploitation activity.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.