{"id":26579,"date":"2025-07-13T22:35:22","date_gmt":"2025-07-13T19:35:22","guid":{"rendered":"https:\/\/digitrendz.blog\/?p=26579"},"modified":"2025-07-13T22:35:26","modified_gmt":"2025-07-13T19:35:26","slug":"critical-rce-flaw-in-wing-ftp-server-actively-exploited-by-hackers","status":"publish","type":"post","link":"https:\/\/digitrendz.blog\/z\/newswire\/technology\/26579\/critical-rce-flaw-in-wing-ftp-server-actively-exploited-by-hackers\/","title":{"rendered":"Critical RCE Flaw in Wing FTP Server Actively Exploited by Hackers"},"content":{"rendered":"
\u25bc Summary<\/summary>\n

– Hackers began exploiting a critical Wing FTP Server vulnerability (CVE-2025-47812) one day after its technical details were published, allowing unauthenticated remote code execution with root\/SYSTEM privileges.
– The flaw combines a null byte bypass and Lua code injection, stemming from unsafe string handling in C++ and improper input sanitization in Lua scripts.
– Three additional vulnerabilities were disclosed alongside CVE-2025-47812, including password exfiltration (CVE-2025-27889) and path disclosure (CVE-2025-47813), all fixed in Wing FTP version 7.4.4 except for CVE-2025-47811.
– Attackers exploited the flaw by injecting null-byte usernames to create malicious Lua session files, executing payloads via cmd.exe to download malware, though some attempts were thwarted by Microsoft Defender.
– Organizations are urged to upgrade to Wing FTP 7.4.4 or restrict HTTP\/HTTPS access, disable anonymous logins, and monitor session directories for suspicious activity.
<\/p>\n<\/details>\n\n

<\/p>\n\n

A<\/mark> critical remote code execution<\/a> vulnerability in Wing FTP Server<\/a> is now being actively exploited by hackers, posing severe risks to organizations using this popular file transfer solution.<\/strong> The flaw, identified as CVE-2025-47812<\/a><\/strong>, allows attackers to execute arbitrary code with the highest system privileges without authentication. Security experts warn that exploitation attempts<\/a> began just 24 hours after technical details became public.<\/p>\n\n

The vulnerability stems from improper handling of null-terminated strings in C++ and insufficient input sanitization in Lua<\/a> scripts. Attackers can inject malicious code through the username field during login, bypassing authentication checks. When the server processes session files containing this code, it executes commands with root or SYSTEM privileges, giving hackers full control over the system.<\/p>\n\n

Alongside this critical flaw, researchers uncovered three additional vulnerabilities in Wing FTP Server:<\/p>\n\n