CVE-2025-47812 Wing FTP Server Wing FTP Server: software flaw
In plain words: A mistake in the software that attackers have found a way to abuse. Depends on the product — see the description and the vendor advisory.
Confirmed exploited by CISA on · US federal patch deadline Aug 4, 2025
What to do
- Install Wing FTP Server's security update for Wing FTP Server. If no update exists, follow the vendor's workaround or stop using the product until one ships.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
- Put admin and file-transfer apps behind a VPN or single sign-on instead of the open internet.
Who is affected
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
What's at risk: Mass data theft and ransomware: a single flaw in a file-transfer or email server has exposed thousands of organisations at once.
The details
- Official name
- Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
- Product
- Wing FTP Server Wing FTP Server
- CISA description
- Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default).
- Type of flaw
- Software flaw (CWE-158)
- Confirmed exploited
- Jul 14, 2025
- US federal patch deadline
- Aug 4, 2025
Ask Cleus about it
Ask about a vulnerability, an update, a weird message, or the news. Plain-word answers, free, no account.
Answering about CVE-2025-47812 ·
Questions about CVE-2025-47812
Is CVE-2025-47812 being exploited?
Yes. CISA added CVE-2025-47812 to its Known Exploited Vulnerabilities catalog on Jul 14, 2025, which means there is reliable evidence of real-world attacks.
How do I fix CVE-2025-47812?
Install Wing FTP Server's security update for Wing FTP Server. If no update exists, follow the vendor's workaround or stop using the product until one ships. Keep a list of every internet-facing server you run so nothing is forgotten.
Am I affected by CVE-2025-47812?
Only if you use Wing FTP Server Wing FTP Server. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.