{"id":"CVE-2025-47812","published":"2025-07-10T17:15:47Z","modified":"2026-06-17T09:28:43Z","title":"Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability","vendor":"Wing FTP Server","product":"Wing FTP Server","tier":"core","eol":null,"description":{"text":"In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.","provenance":"source","from":"NVD"},"summary":{"text":"Wing FTP Server's user and admin web interfaces mishandle null (NUL, \"\\0\") bytes, which lets an attacker inject arbitrary Lua code into user session files. An attacker with network access can exploit this without authentication or user interaction, including via anonymous FTP accounts, to run arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default) and fully compromise the server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:07:45Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.93884,"percentile":0.99844,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-07-14","dueDate":"2025-08-04","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.wftpserver.com/serverhistory.htm ; https://nvd.nist.gov/vuln/detail/CVE-2025-47812","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-07-10","exploitedFirstSeen":"2025-07-10","ransomware":false,"evidence":[{"url":"https://www.huntress.com/blog/wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild","date":"2025-07-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-14&host_type=src&vulnerability=cve-2025-47812","date":"2025-07-14"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-07-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-15&host_type=src&vulnerability=cve-2025-47812","date":"2025-07-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-16&host_type=src&vulnerability=cve-2025-47812","date":"2025-07-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-17&host_type=src&vulnerability=cve-2025-47812","date":"2025-07-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-18&host_type=src&vulnerability=cve-2025-47812","date":"2025-07-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-19&host_type=src&vulnerability=cve-2025-47812","date":"2025-07-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-20&host_type=src&vulnerability=cve-2025-47812","date":"2025-07-20"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-47812","date":"2025-07-21"}],"evidenceTotal":262,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-158","name":"Improper Neutralization of Null Byte or NUL Character"}],"references":[{"url":"https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-47812-detection-script-remote-code-execution-vulnerability-in-wing-ftp-server","tags":["Third Party Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-47812-mitigation-script-remote-code-execution-vulnerability-in-wing-ftp-server","tags":["Mitigation","Third Party Advisory"]},{"url":"https://www.wftpserver.com","tags":["Product"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47812","tags":["US Government Resource"]},{"url":"https://www.huntress.com/blog/wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild","tags":["Exploit","Third Party Advisory"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Input Validation","mappingType":"exploitation_technique","evidence":[],"comment":"An attacker can craft a message in Lua that injects a null byte, allowing admin access to Wing FTP sessions.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Input Validation","mappingType":"primary_impact","evidence":[],"comment":"An attacker can craft a message in Lua that injects a null byte, allowing admin access to Wing FTP sessions.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-21009","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-21009","exploited":true,"exploitedSince":"2025-07-14","provenance":"source"},"exploits":[{"id":52347,"url":"https://www.exploit-db.com/exploits/52347","title":"Wing FTP Server 7.4.3 - Unauthenticated Remote Code Execution  (RCE)","type":"remote","platform":"multiple","date":"2025-07-02","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-07-02"},"pocGithub":{"count":17,"skipped":1,"earliest":"2025-07-01","earliestUrl":"https://github.com/4m3rr0r/CVE-2025-47812-poc","repos":[{"name":"4m3rr0r/CVE-2025-47812-poc","url":"https://github.com/4m3rr0r/CVE-2025-47812-poc","stars":54,"created":"2025-07-01"},{"name":"0xcan1337/CVE-2025-47812-poC","url":"https://github.com/0xcan1337/CVE-2025-47812-poC","stars":13,"created":"2025-07-01"},{"name":"0xgh057r3c0n/CVE-2025-47812","url":"https://github.com/0xgh057r3c0n/CVE-2025-47812","stars":3,"created":"2025-07-02"},{"name":"r0otk3r/CVE-2025-47812","url":"https://github.com/r0otk3r/CVE-2025-47812","stars":2,"created":"2025-07-27"},{"name":"shadowgit30/CVE-2025-47812","url":"https://github.com/shadowgit30/CVE-2025-47812","stars":2,"created":"2026-02-17"}]},"metasploit":[{"name":"Wing FTP Server Authenticated Command Execution","module":"exploit/windows/ftp/wing_ftp_admin_exec","type":"exploit","disclosureDate":"2014-06-19","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/ftp/wing_ftp_admin_exec.rb"},{"name":"Wing FTP Server NULL-byte Authentication Bypass (CVE-2025-47812)","module":"exploit/multi/http/wingftp_null_byte_rce","type":"exploit","disclosureDate":"2025-06-30","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wingftp_null_byte_rce.rb"}],"nuclei":[{"id":"CVE-2025-47812","name":"Wing FTP Server <= 7.4.3 - Remote Code Execution","severity":"critical","path":"http/cves/2025/CVE-2025-47812.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47812.yaml"}],"first":{"date":"2014-06-19","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/ftp/wing_ftp_admin_exec.rb"},"provenance":"source"},"exploitRefs":["https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/","https://www.huntress.com/blog/wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild"],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2014-06-19","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2025-07-01, Exploit-DB 2025-07-02","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/ftp/wing_ftp_admin_exec.rb","provenance":"source"},{"date":"2025-07-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47812","provenance":"source"},{"date":"2025-07-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.huntress.com/blog/wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild","provenance":"source"},{"date":"2025-07-14","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-07-14","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-21009","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":4},"priority":{"score":70.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 478 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9984"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Exploit-DB entry; 17 PoC-in-GitHub repos; 2 Metasploit modules; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}