A just lately disclosed maximum-severity safety flaw impacting the Wing FTP Server has come underneath lively exploitation within the wild, in keeping with Huntress.
The vulnerability, tracked as CVE-2025-47812 (CVSS rating: 10.0), is a case of improper dealing with of null (‘ ’) bytes within the server’s net interface, which permits for distant code execution. It has been addressed in model 7.4.4.
“The person and admin net interfaces mishandle ‘ ’ bytes, finally permitting injection of arbitrary Lua code into person session recordsdata,” in keeping with an advisory for the flaw on CVE.org. “This can be utilized to execute arbitrary system instructions with the privileges of the FTP service (root or SYSTEM by default).”
What makes it much more regarding is that the flaw may be exploited by way of nameless FTP accounts. A complete breakdown of the vulnerability entered the general public area in the direction of the tip of June 2025, courtesy of RCE Safety researcher Julien Ahrens.
Cybersecurity firm Huntress mentioned it noticed menace actors exploiting the flaw to obtain and execute malicious Lua recordsdata, conduct reconnaissance, and set up distant monitoring and administration software program.
“CVE-2025-47812 stems from how null bytes are dealt with within the username parameter (particularly associated to the loginok.html file, which handles the authentication course of),” Huntress researchers mentioned. “This may enable distant attackers to carry out Lua injection after utilizing the null byte within the username parameter.”
“By benefiting from the null-byte injection, the adversary disrupts the anticipated enter within the Lua file which shops these session traits.”
Proof of lively exploitation was first noticed towards a single buyer on July 1, 2025, merely a day after particulars of the exploit had been disclosed. Upon gaining entry, the menace actors are mentioned to have run enumeration and reconnaissance instructions, created new customers as a type of persistence, and dropped Lua recordsdata to drop an installer for ScreenConnect.
There isn’t any proof that the distant desktop software program was truly put in, because the assault was detected and stopped earlier than it may progress any additional. It is at present not clear who’s behind the exercise.
Knowledge from Censys reveals that there are 8,103 publicly-accessible gadgets operating Wing FTP Server, out of which 5,004 have their net interface uncovered. The vast majority of the cases are positioned within the U.S., China, Germany, the U.Ok., and India.
In gentle of lively exploitation, it is important that customers transfer shortly to use the most recent patches and replace their Wing FTP Server variations of seven.4.4 or later.