Detections
Analytics
CVE-2025-47812
critical
Description
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.
References
https://www.securityweek.com/cisa-flags-year-old-wing-ftp-vulnerability-as-exploited/
https://thehackernews.com/2026/03/cisa-flags-actively-exploited-wing-ftp.html
https://www.bitsight.com/blog/rondodox-botnet-infrastructure-analysis
https://therecord.media/exploited-file-transfer-bug-cisa
https://www.theregister.com/2025/07/11/1010_wing_ftp_bug_exploited/
https://www.securityweek.com/critical-wing-ftp-server-vulnerability-exploited/
https://www.huntress.com/blog/wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild
https://thehackernews.com/2025/07/critical-wing-ftp-server-vulnerability.html
https://github.com/Denis-Krueger-labs/Wing-FTP-CVE
https://github.com/ZeroTrustWraith/Exploit-PoC
https://github.com/ZemarKhos/CVE-2026-44403-WingFTP-v8.1.2-POC-Exploit
https://github.com/H3XploR/Exploit_CVE-2025-47812
https://github.com/Agentpathogene/CTf-CVE.py
https://github.com/0xjuarez/CVE-2025-47812
https://github.com/popyue/CVE-2025-47812
https://github.com/matesz44/CVE-2025-47812
https://github.com/MatteoLupinacci/PoC4CVEs
https://github.com/R4ptX/DeepDives
https://github.com/r0otk3r/CVE-2025-47812
https://github.com/B1ack4sh/Blackash-CVE-2025-47812
https://github.com/blindma1den/CVE-2025-47812
https://github.com/rxerium/CVE-2025-47812
https://github.com/pevinkumar10/CVE-2025-47812
https://github.com/nkbeast/New-CVE-Templates
https://github.com/0xgh057r3c0n/CVE-2025-47812
https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47812
Details
Published: 2025-07-10
Updated: 2025-11-05
Known Exploited Vulnerability (KEV)
Risk Information
CVSS v2
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Severity: Critical
CVSS v3
Base Score: 10
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: Critical
EPSS
EPSS: 0.92862
Vulnerability Watch
Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.
Vulnerability of Interest