CRITICALCVSS 10.0Actively exploited · CISA KEV since 2025-07-14Vulnerability

CVE-2025-47812

Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default).

Properties

Euvd product
Wing FTP Server
Vulnerability name
Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
First seen
2026-02-26T17:50:49+00:00
Cvss score
10
Epss score
0.93884
Last seen
2026-10-19T12:00:27+00:00
Due date
2025-08-04
Euvd assigner
mitre
Retrieved at
2026-10-21T01:24:47+00:00
Exploited euvd since
2025-07-14T00:00:00+00:00
Src batch id
epss_history-20261020T103617Z-728ddd
Source url
https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
Date added
2025-07-14
Euvd base score version
3.1
Score
10
Fetched at
2026-10-20T10:36:20+00:00
Euvd vendor
wftpserver, Wing FTP Server
Cvss vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
In Signal since
initial import (Sep 2026)
Euvd base score
10

Related Entities (8)

MENTIONED_IN (4)

→[Campaign]Untangling a Linux Incident With an OpenAI Twist
→[Campaign]The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
→[Campaign]Unnamed campaign (ID 69b1…)
→[Campaign]RondoDox Botnet: From Zero to 174 Exploited Vulnerabilities

AFFECTS_PRODUCT (1)

→[Product]cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:*

DESCRIBES (1)

←[KEVEntry]Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability

HAS_WEAKNESS (1)

→[Weakness]Improper Neutralization of Null Byte or NUL Character

INVOLVES (1)

←[Signal]kev_added · 2025-07-14

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2025-47812 (CVSS 10) — Ninja Signal Threat Intelligence | Ninja Signal