A lately disclosed maximum-severity safety flaw impacting the Wing FTP Server has come underneath lively exploitation within the wild, in accordance with Huntress.
The vulnerability, tracked as CVE-2025-47812 (CVSS rating: 10.0), is a case of improper dealing with of null (‘ ’) bytes within the server’s internet interface, which permits for distant code execution. It has been addressed in model 7.4.4.
“The person and admin internet interfaces mishandle ‘ ’ bytes, finally permitting injection of arbitrary Lua code into person session recordsdata,” in accordance with an advisory for the flaw on CVE.org. “This can be utilized to execute arbitrary system instructions with the privileges of the FTP service (root or SYSTEM by default).”
What makes it much more regarding is that the flaw will be exploited through nameless FTP accounts. A complete breakdown of the vulnerability entered the general public area in direction of the tip of June 2025, courtesy of RCE Safety researcher Julien Ahrens.
Cybersecurity firm Huntress stated it noticed menace actors exploiting the flaw to obtain and execute malicious Lua recordsdata, conduct reconnaissance, and set up distant monitoring and administration software program.
“CVE-2025-47812 stems from how null bytes are dealt with within the username parameter (particularly associated to the loginok.html file, which handles the authentication course of),” Huntress researchers stated. “This could permit distant attackers to carry out Lua injection after utilizing the null byte within the username parameter.”
“By profiting from the null-byte injection, the adversary disrupts the anticipated enter within the Lua file which shops these session traits.”
Proof of lively exploitation was first noticed in opposition to a single buyer on July 1, 2025, merely a day after particulars of the exploit had been disclosed. Upon gaining entry, the menace actors are stated to have run enumeration and reconnaissance instructions, created new customers as a type of persistence, and dropped Lua recordsdata to drop an installer for ScreenConnect.
There is no such thing as a proof that the distant desktop software program was really put in, because the assault was detected and stopped earlier than it may progress any additional. It is presently not clear who’s behind the exercise.
Information from Censys reveals that there are 8,103 publicly-accessible gadgets working Wing FTP Server, out of which 5,004 have their internet interface uncovered. Nearly all of the situations are situated within the U.S., China, Germany, the U.Ok., and India.
In gentle of lively exploitation, it is important that customers transfer rapidly to use the newest patches and replace their Wing FTP Server variations of seven.4.4 or later.
