CVE-2025-47812: Wing FTP Server null-byte flaw to root/SYSTEM RCE, exploited in the wild
The short version: Wing FTP Server has a null-byte handling flaw (CVE-2025-47812) that lets an attacker inject Lua code into a session file and execute commands as root or SYSTEM — the FTP service's default privileges — and it works even through anonymous accounts. It's exploited in the wild, it's in CISA's KEV catalog, and a fix exists. Patch now. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 10.0 — Critical · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| EPSS | ~95.3% · 99.9th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2025-08-04 |
| Known exploited? | Yes — KEV-listed; exploited in the wild shortly after disclosure |
| Vulnerability type | CWE-158 improper null-byte handling → Lua code injection → remote code execution as root/SYSTEM |
| Requires authenticated session? | No — exploitable via anonymous FTP accounts |
| Affected | Wing FTP Server before 7.4.4 |
| Fixed in | 7.4.4 (and later) |
What you need to know
CVE-2025-47812 is a flaw in how Wing FTP Server's web interfaces handle null (\0) bytes. A malformed username lets an attacker inject arbitrary Lua code into a user session file; when that file is processed, the injected code runs — yielding command execution with the FTP service's privileges, which are root or SYSTEM by default. That's total server compromise.
Why this is as bad as external exposure gets:
- It runs as root/SYSTEM. Code execution at the highest privilege on the host, not a sandboxed corner.
- Anonymous accounts work. Where anonymous FTP is enabled, no valid credential is required at all.
- It was live fast. Researchers published details and in-the-wild exploitation followed quickly — an exposed, unpatched server may already have been hit.
How serious we see it
High — the 10.0 is not hyperbole here.
Unauthenticated, network-reachable code execution as root/SYSTEM on an internet-facing file server, confirmed exploited and KEV-listed, is the definition of top-of-queue. We rate it by what it does. The bounded, reassuring part is that it's specific and fixed: Wing FTP before 7.4.4, with a published fix and quick-to-confirm exposure. The catch is the usual one — patched and clean are separate questions, so hunt as well as patch.
Recommendations
Straight from the vendor's guidance and CISA:
- Patch now. Upgrade Wing FTP Server to 7.4.4 or later.
- Disable anonymous access. Turn off anonymous FTP accounts unless there's a hard requirement — they make this trivially reachable.
- Hunt for prior use. Review for indicators of compromise and unexpected session files or processes given active exploitation.
- If compromised, respond. Rebuild the host and rotate all credentials and secrets it could reach — root/SYSTEM compromise means assume everything on the box is exposed.
- Restrict and confirm exposure. Keep the web interface off the open internet where possible, and verify which Wing FTP build you run.
How BreachRisk sees it
BreachRisk discovers internet-facing Wing FTP interfaces from the outside, fingerprints the version, and flags exposure tied to this KEV-listed, actively exploited CVE so it rises to the top of your results. Where safe verification is possible, it sends a single bounded login request with a malformed username and checks the response for the tell-tale behavior — confirming the flaw responds without deploying a payload or harming the server. That's the difference between "this looks like a vulnerable Wing FTP" and "we confirmed the exposure."