Skip to main content

CVE-2025-47811: CWE-267 Privilege Defined With Unsafe Actions in wftpserver Wing FTP Server

Medium
VulnerabilityCVE-2025-47811cvecve-2025-47811cwe-267
Published: Thu Jul 10 2025 (07/10/2025, 00:00:00 UTC)
Source: CVE Database V5
Vendor/Project: wftpserver
Product: Wing FTP Server

Description

In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default. The web application itself offers several legitimate ways to execute arbitrary system commands (i.e., through the web console or the task scheduler), and they are automatically executed in the highest possible privilege context. Because administrative users of the web interface are not necessarily also system administrators, one might argue that this is a privilege escalation. (If a privileged application role is not available to an attacker, CVE-2025-47812 can be leveraged.) NOTE: the vendor reportedly considers this behavior "fine to keep."

Technical Details

Data Version
5.1
Assigner Short Name
mitre
Date Reserved
2025-05-10T00:00:00.000Z
Cvss Version
3.1
State
PUBLISHED

Threat ID: 686ff1d3a83201eaaca8df00

Added to database: 7/10/2025, 5:01:07 PM

Last updated: 7/10/2025, 5:01:07 PM

Views: 1

Actions

Please log in to the Console to use AI analysis features.

Need enhanced features?

Contact root@offseq.com for Pro access with improved analysis and higher rate limits.

Latest Threats