CVE-2025-47812: Wing FTP Server null byte handling leads to Lua code injection RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 10.0, KEV listing with confirmed in-the-wild exploitation, and very high EPSS make this an urgent patch-first issue.

What it is

Wing FTP Server before 7.4.4 mishandles '\0' bytes in its user and admin web interfaces, allowing injection of arbitrary Lua code into user session files. Because the injected code runs with the privileges of the FTP service, this is a remote code execution flaw that can fully compromise the server. It is also reachable through anonymous FTP accounts, widening the pool of potential attackers.

Impact

An attacker can execute arbitrary system commands with the privileges of the FTP service, which runs as root or SYSTEM by default, resulting in total server compromise.

Attack surface

Reachable over the network through the user and admin web interfaces, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The description additionally notes exploitability via anonymous FTP accounts.

Exploitation

CISA added this to KEV on 2025-07-14 with a due date of 2025-08-04, and references include exploit write-ups and a report of in-the-wild exploitation. EPSS is 0.92862 (99.8th percentile), indicating very high likelihood of exploitation activity.

What to do

• Upgrade Wing FTP Server to 7.4.4 or later immediately.
• If patching is not possible, follow vendor mitigations or discontinue use of the product per CISA BOD 22-01 guidance.
• Disable or restrict anonymous FTP access and limit exposure of the web interfaces to trusted networks.
• Run the FTP service under a least-privilege account instead of root or SYSTEM where feasible.
• Monitor CISA KEV guidance and apply the required action by the 2025-08-04 due date.

Detection

• Inspect Wing FTP Server session files for unexpected or injected Lua code.
• Monitor for suspicious child processes spawned by the FTP service, especially command shells.
• Review web interface and FTP logs for requests containing null bytes or unusual encoding.
• Alert on anonymous FTP logins followed by file writes or command execution activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.