CVE-2025-47812: Wing FTP Server Null-Byte Lua Injection RCE (KEV, Exploited)

CVE-2025-47812 is a null-byte handling flaw in Wing FTP Server's web login that lets an attacker — even one using an anonymous FTP account — inject arbitrary Lua code into a session file and have the server execute it, running arbitrary system commands as root or SYSTEM, and it was already being exploited in the wild within a day of public disclosure.

CVE-2025-47812 (CWE-158, improper neutralization of null byte or NUL character) affects Wing FTP Server before 7.4.4. NVD's description states that the user and admin web interfaces "mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files," that this "can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default)," and explicitly notes it "is also exploitable via anonymous FTP accounts" (NVD).

Huntress's incident-response writeup, drawing on in-the-wild telemetry, describes the root cause as a "null byte and Lua injection flaw" in the loginok.html authentication flow, where an attacker-controlled username parameter disrupts string processing and lets malicious Lua get written into the victim's session object — achieving root/SYSTEM-level remote code execution once that Lua runs (Huntress: Wing FTP Server RCE CVE-2025-47812 Exploited in the Wild).

The flaw was disclosed publicly by researcher Julien Ahrens on 2025-06-30; Huntress observed real-world exploitation starting the very next day, 2025-07-01, from multiple attacker-controlled IP addresses, with activity escalating to reconnaissance commands (ipconfig, whoami, arp), attempts to create persistent accounts, and attempts to download additional malware and remote-access tools (Huntress; rcesecurity.com: What the Null — Wing FTP Server RCE).

NVD has not published an independent CVSS score for this CVE; the only CVSS on record is from the MITRE CNA submission: v3.1 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. This page reports that CNA-sourced score rather than presenting it as an NVD Primary figure (NVD).

CISA added CVE-2025-47812 to the Known Exploited Vulnerabilities (KEV) catalog on 2025-07-14, with a required-action due date of 2025-08-04 (CISA KEV).

Wing FTP fixed the issue in version 7.4.4, released 2025-05-14 ahead of public disclosure, per the vendor's own version history (Wing FTP Server History).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.9388 (99.844th percentile), among the highest in this library, reflecting both the unauthenticated/anonymous-accessible attack path and documented mass exploitation within hours of disclosure (FIRST EPSS).

Any Wing FTP Server instance below 7.4.4 should be upgraded immediately — anonymous FTP access alone is sufficient to trigger this flaw — and checked for the indicators of compromise Huntress documented, including unexpected local accounts and dropped remote-access tooling.

• The web interfaces mishandle null bytes in a way that lets an attacker inject arbitrary Lua code into user session files, leading to arbitrary system command execution as root/SYSTEM; exploitable via anonymous FTP accounts. — NVD
• Root cause is a null-byte/Lua injection flaw in the loginok.html authentication flow; a crafted username parameter disrupts string processing and writes malicious Lua into the session object, achieving root/SYSTEM RCE. — Huntress
• Disclosed 2025-06-30; in-the-wild exploitation observed starting 2025-07-01 from multiple attacker IPs, including reconnaissance commands, persistent-account creation attempts, and malware/RAT download attempts. — Huntress
• No NVD Primary CVSS has been published; the MITRE CNA scored it CVSS v3.1 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2025-07-14, due date 2025-08-04. — CISA KEV
• Fixed in Wing FTP Server 7.4.4, released 2025-05-14. — Wing FTP Server History
• EPSS score is 0.9388 (99.844th percentile) as of 2026-10-29. — FIRST EPSS