# CVE-2025-47812

## Summary

- **CVE ID:** CVE-2025-47812
- **Severity:** CRITICAL
- **CVSS Score:** 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- **CWE:** CWE-158
- **Published:** Jul 10, 2025
- **Last Modified:** Feb 26, 2026

## Description

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.

## Affected Products

- wftpserver — Wing FTP Server (0)

## References

- [CNA](https://www.wftpserver.com)
- [CNA](https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/)
- [CNA](https://www.vicarius.io/vsociety/posts/cve-2025-47812-mitigation-script-remote-code-execution-vulnerability-in-wing-ftp-server)
- [CNA](https://www.vicarius.io/vsociety/posts/cve-2025-47812-detection-script-remote-code-execution-vulnerability-in-wing-ftp-server)
- [CISA-ADP](https://www.huntress.com/blog/wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild)
- [CISA-ADP](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47812)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 92.86%
- **EPSS Percentile:** 99.8

## Known Exploited Vulnerabilities (KEV)

- **Date Added:** Jul 14, 2025
- **Due Date:** Aug 4, 2025

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-12._