Search: CVE-2025-47812

CVE-2025-47812 is a critical vulnerability in Wing FTP Server involving improper neutralization of null byte or NUL characters. This flaw allows injection of arbitrary Lua code into user session files, enabling execution of system commands with the FTP service's privileges, which are typically root or SYSTEM. The vulnerability has a CVSS score of 10, indicating maximum severity, and is known to be exploited in the wild.

A threat actor exploited a path traversal vulnerability (CVE-2025-4632) in Samsung MagicINFO 9 Server to gain unauthorized access to endpoints. They deployed a rogue AnyDesk remote access tool, created a local administrator account, and disabled Microsoft Defender protections. Instead of deploying a pre-compiled cryptominer, the actor compiled a Monero cryptominer directly on the compromised endpoint using multiple compilers and utilities. The miner connected to the C3Pool mining service and ran under explorer.exe with suspicious arguments. This on-endpoint compilation generated significant endpoint detection and response (EDR) telemetry, increasing detectability despite attempts at stealth.