CVE-2023-40044

Progress WS_FTP Server Deserialization of Untrusted Data

10.0 CRITICALActively exploited (CISA KEV)Used in ransomwarePublic exploitEPSS 90.4%

Published27 Sept 2023
Added to CISA KEV5 Oct 2023
Remediation due26 Oct 2023

Description

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Progress Ws FTP Server≥ 8.8 < 8.8.2 · < 8.7.4

Remediation

Fixed in

Progress Ws FTP Server≥ 8.8.2

Patch & vendor advisories

https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023

References

http://packetstormsecurity.com/files/174917/Progress-Software-WS_FTP-Unauthenticated-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
https://attackerkb.com/topics/bn32f9sNax/cve-2023-40044Third Party Advisory
https://censys.com/cve-2023-40044/Third Party Advisory
https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023Vendor Advisory
https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044ExploitThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-40044US Government Resource
https://www.progress.com/ws_ftpProduct
https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/Broken LinkThird Party Advisory
https://www.theregister.com/2023/10/02/ws_ftp_update/Press/Media CoverageThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2023-40044 being actively exploited?

Yes. CVE-2023-40044 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 5 Oct 2023. It has been used in ransomware campaigns.

How severe is CVE-2023-40044?

CVE-2023-40044 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 90.4% probability of exploitation.

Which products are affected by CVE-2023-40044?

Affected products include Progress Ws FTP Server.

How do I fix CVE-2023-40044?

Upgrade affected software to a fixed version, for example Progress Ws FTP Server 8.8.2 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-40044 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.