Report · Reddit NetSecAbout CVE-2025-47812Published 30 Jun 2025

CVE-2025-47812: What the NULL?! Wing FTP Server RCE

Affects Wing FTP ServerSource Reddit NetSec

Authoritative record:CVE-2025-47812· Critical 10.0

Exploited in the wild · KEV due 4 Aug 2025 · public exploit available (Metasploit, Exploit-DB) · 93% EPSS : upgrade to 7.4.4 now.

Data as of 26 Oct 2026, 07:57 UTC

CVSS base score

10.0Critical

How severe the flaw is on the 0–10 CVSS scale.

KEV deadline: 4 Aug 2025 US federal agencies must patch by this date; a sensible deadline for everyone else.
EPSS: 93.8% chance of exploitation in 30 days – higher than 99% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 7.4.4

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 10 Jul 2025
Detectable: evidence found.
nuclei template: Wing FTP Server <= 7.4.3 - Remote Code Execution
Weaponised: evidence found.
2 Metasploit modules · 1 Exploit-DB entry, 8 days before disclosure
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 4 days after disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

First Exploit-DB entry (opens in a new tab)
Wing FTP Server 7.4.3 - Unauthenticated Remote Code Execution (RCE)
2025-07-02, 8 days before disclosure
CVE published
on cve.org
2025-07-10, t = 0
Added to CISA KEV (opens in a new tab)
exploitation confirmed
2025-07-14, 4 days after disclosure
In Threat Radar
record ingested
2025-07-1500:00Z, 5 days after disclosure
KEV remediation due
US federal deadline
2025-08-04, 25 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Wing FTP Server to 7.4.4.

Affected software

Product	Affected	Fixed in
wftpserverWing FTP Server	Affected <7.4.4	Fixed in 7.4.4

Description

CVE-2025-47812 is a remote code execution vulnerability in Wing FTP Server disclosed in June 2025. It allows unauthenticated attackers to execute arbitrary code, which could lead to full system compromise. The vulnerability is considered high risk due to the ease of exploitation without authentication. Current mitigations focus on heightened monitoring, network segmentation, and restricting access to the FTP server until a patch is available. Organizations using Wing FTP Server, especially in Europe, face elevated risk. Defenders should prioritize anomaly detection on FTP traffic and prepare for rapid patch deployment once released.

Impact

The vulnerability allows unauthenticated remote attackers to execute arbitrary code on affected Wing FTP Server instances, potentially leading to full system compromise. This poses a significant risk to organizations relying on Wing FTP Server for critical file transfers. No known exploits have been observed in the wild to date.

Mitigation

Organizations should restrict access to the Wing FTP Server, implement network segmentation, and increase monitoring and anomaly detection on FTP traffic. Prepare for rapid deployment of an official patch once it is released.

Summary

CVE-2025-47812 is a remote code execution vulnerability affecting Wing FTP Server, disclosed in June 2025. It permits unauthenticated attackers to execute arbitrary code remotely, potentially resulting in full system compromise. Due to the lack of authentication requirements for exploitation, the vulnerability is considered high risk. Mitigations currently recommended include monitoring, network segmentation, and access restrictions until an official fix is available.

Metasploit modules

Exploit-DB

Wing FTP Server 7.4.3 - Unauthenticated Remote Code Execution (RCE)2025-07-02 (opens in a new tab)

Nuclei detection templates

Wing FTP Server <= 7.4.3 - Remote Code Executioncritical (opens in a new tab)

Public tooling indexed from Metasploit Framework, Exploit-DB and ProjectDiscovery nuclei-templates. Its existence raises the odds of exploitation; it does not confirm attacks.

CWE-158Improper Neutralization of Null Byte or NUL Character (opens in a new tab)
Variant weakness
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.
Developers should anticipate that null characters or null bytes will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
Deserialization (opens in a new tab)
Server Side Request Forgery Prevention (opens in a new tab)
Unvalidated Redirects and Forwards (opens in a new tab)
Cross Site Scripting Prevention (opens in a new tab)
OWASP ASVS 4.0.3
V1.5.1 (opens in a new tab)
V5.2.2 (opens in a new tab)
Attack patterns
Embedding NULL Bytes (opens in a new tab)
Postfix, Null Terminate, and Backslash (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Affected software

Description

AI analysisMachine-generated, updated 18 May 2026, 08:51 UTC

Public exploits and detection2 Metasploit modules, 1 Exploit-DB entry, a Nuclei detection template

WeaknessesCWE-158

Technical details

References

Community reviews

Related threats