A just lately disclosed maximum-severity safety flaw impacting the Wing FTP Server has come beneath energetic exploitation within the wild, in keeping with Huntress.
The vulnerability, tracked as CVE-2025-47812 (CVSS rating: 10.0), is a case of improper dealing with of null (‘ ’) bytes within the server’s internet interface, which permits for distant code execution. It has been addressed in model 7.4.4.
“The consumer and admin internet interfaces mishandle ‘ ’ bytes, finally permitting injection of arbitrary Lua code into consumer session information,” in keeping with an advisory for the flaw on CVE.org. “This can be utilized to execute arbitrary system instructions with the privileges of the FTP service (root or SYSTEM by default).”
What makes it much more regarding is that the flaw could be exploited through nameless FTP accounts. A complete breakdown of the vulnerability entered the general public area in direction of the top of June 2025, courtesy of RCE Safety researcher Julien Ahrens.
Cybersecurity firm Huntress stated it noticed risk actors exploiting the flaw to obtain and execute malicious Lua information, conduct reconnaissance, and set up distant monitoring and administration software program.
“CVE-2025-47812 stems from how null bytes are dealt with within the username parameter (particularly associated to the loginok.html file, which handles the authentication course of),” Huntress researchers stated. “This will permit distant attackers to carry out Lua injection after utilizing the null byte within the username parameter.”
“By benefiting from the null-byte injection, the adversary disrupts the anticipated enter within the Lua file which shops these session traits.”
Proof of energetic exploitation was first noticed towards a single buyer on July 1, 2025, merely a day after particulars of the exploit had been disclosed. Upon gaining entry, the risk actors are stated to have run enumeration and reconnaissance instructions, created new customers as a type of persistence, and dropped Lua information to drop an installer for ScreenConnect.
There is no such thing as a proof that the distant desktop software program was really put in, because the assault was detected and stopped earlier than it may progress any additional. It is at present not clear who’s behind the exercise.
Knowledge from Censys exhibits that there are 8,103 publicly-accessible units operating Wing FTP Server, out of which 5,004 have their internet interface uncovered. Nearly all of the situations are positioned within the U.S., China, Germany, the U.Okay., and India.
In mild of energetic exploitation, it is important that customers transfer shortly to use the newest patches and replace their Wing FTP Server variations of seven.4.4 or later.
