10/10 Wing FTP bug exploited within hours, cyber pros say

Huntress security researchers observed exploitation of the CVSS 10.0 remote code execution (RCE) flaw in Wing FTP Server on July 1, just one day after its public disclosure. Wing FTP Server is a cross-platform file-transfer solution, supporting FTP, FTPS, SFTP, and HTTP/S. It is used by over 10,000 customers worldwide for secure data exchange, including Airbus, Reuters, and the US Air Force, according to its website. Patched on May 14, the researchers behind the discovery of CVE-2025-47812 did not publish their findings until over a month after fixes came in version 7.4.4. RCE Security, which found and reported the issue, said in its report on June 30 that once Lua code is injected into a session file, execution as root on affected Wing FTP instances is trivial, hence the maximum possible severity score. The main issue at play was the way in which the Wing FTP web interface handled null bytes in the username field, allowing attackers to execute a Lua injection attack. If an attacker appended a username input with a %00 null byte, anything after that would be interpreted as Lua code ­­- which would then be injected into session object files and deserialized by the application. Huntress said that it was only aware of one successful in-the-wild exploit attempt for this vulnerability, but urged users to patch regardless, if they have not already. The attackers did not seem too sophisticated, the researchers noted, saying they seemed incapable of causing much damage before their a...