Secuno
ENNL
Book demo

CVE-2025-47812

Wing FTP Server Improper Neutralization of Null Byte or NUL Character

10.0 CRITICALActively exploited (CISA KEV)Public exploitEPSS 93.9%
  1. Published10 Jul 2025
  2. Added to CISA KEV14 Jul 2025
  3. Remediation due4 Aug 2025
Actively exploited (CISA KEV)

Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default).

Added to KEV: 14 Jul 2025Federal remediation due: 4 Aug 2025

Description

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Wftpserver Wing FTP Server< 7.4.4

Remediation

Fixed in
Wftpserver Wing FTP Server≥ 7.4.4

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-763548.1
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does…
CVE-2026-331918.6
Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core…
CVE-2025-143889.8
The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File…
CVE-2025-551139.0
If the Access Control List is enforced by the Control-M/Agent and the C router is in…
CVE-2009-15378.8
Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in…

Frequently asked

Is CVE-2025-47812 being actively exploited?

Yes. CVE-2025-47812 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 14 Jul 2025.

How severe is CVE-2025-47812?

CVE-2025-47812 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 93.9% probability of exploitation.

Which products are affected by CVE-2025-47812?

Affected products include Wftpserver Wing FTP Server.

How do I fix CVE-2025-47812?

Upgrade affected software to a fixed version, for example Wftpserver Wing FTP Server 7.4.4 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-47812 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.