A not too long ago disclosed maximum-severity security flaw impacting the Wing FTP Server has come below energetic exploitation within the wild, in keeping with Huntress.
The vulnerability, tracked as CVE-2025-47812 (CVSS rating: 10.0), is a case of improper dealing with of null (‘ ’) bytes within the server’s internet interface, which permits for distant code execution. It has been addressed in model 7.4.4.
“The consumer and admin internet interfaces mishandle ‘ ’ bytes, finally permitting injection of arbitrary Lua code into consumer session information,” in keeping with an advisory for the flaw on CVE.org. “This can be utilized to execute arbitrary system instructions with the privileges of the FTP service (root or SYSTEM by default).”
What makes it much more regarding is that the flaw might be exploited by way of nameless FTP accounts. A complete breakdown of the vulnerability entered the general public area in direction of the tip of June 2025, courtesy of RCE Safety researcher Julien Ahrens.
Cybersecurity firm Huntress stated it noticed risk actors exploiting the flaw to obtain and execute malicious Lua information, conduct reconnaissance, and set up distant monitoring and administration software program.
“CVE-2025-47812 stems from how null bytes are dealt with within the username parameter (particularly associated to the loginok.html file, which handles the authentication course of),” Huntress researchers stated. “This could permit distant attackers to carry out Lua injection after utilizing the null byte within the username parameter.”
“By making the most of the null-byte injection, the adversary disrupts the anticipated enter within the Lua file which shops these session traits.”
Proof of energetic exploitation was first noticed in opposition to a single buyer on July 1, 2025, merely a day after particulars of the exploit have been disclosed. Upon gaining entry, the risk actors are stated to have run enumeration and reconnaissance instructions, created new customers as a type of persistence, and dropped Lua information to drop an installer for ScreenConnect.
There is no such thing as a proof that the distant desktop software program was really put in, because the assault was detected and stopped earlier than it may progress any additional. It is at present not clear who’s behind the exercise.
Data from Censys exhibits that there are 8,103 publicly-accessible units operating Wing FTP Server, out of which 5,004 have their internet interface uncovered. Nearly all of the situations are positioned within the U.S., China, Germany, the U.Ok., and India.
In gentle of energetic exploitation, it is important that customers transfer rapidly to use the newest patches and replace their Wing FTP Server variations of seven.4.4 or later.
