CVE-2025-47812 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session f…
Critical KEV CVSS: 10.0

CVE-2025-47812

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.
Vendor
Wftpserver
Product
Wing Ftp Server
CWE
CWE-158
Yayın Tarihi
2025-07-10 17:15:47
Güncelleme
2025-11-05 19:26:31
Source Identifier
cve@mitre.org
KEV Date Added
2025-07-14

Kategoriler

CWE-158 Wing Ftp Server CRITICAL Wftpserver 2025

Referanslar

https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/ https://www.vicarius.io/vsociety/posts/cve-2025-47812-detection-script-remote-code-execution-vulnerability-in-wing-ftp-server https://www.vicarius.io/vsociety/posts/cve-2025-47812-mitigation-script-remote-code-execution-vulnerability-in-wing-ftp-server https://www.wftpserver.com https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47812 https://www.huntress.com/blog/wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild