What is the CVSS score of EUVD-2025-21009?

EUVD-2025-21009 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 92.7%.

Is there a public PoC exploit available for EUVD-2025-21009?

Yes, a public proof-of-concept exploit is available for EUVD-2025-21009. Prioritise patching immediately. EPSS: 92.7%.

How to fix or mitigate EUVD-2025-21009?

Within 24 hours: Identify all Wing FTP Server instances in your environment and document current versions. Within 7 days: Upgrade all Wing FTP Server installations to version 7.4.4 or later; if immediate patching is impossible, isolate affected servers from untrusted networks and restrict web interface access to known administrator IP ranges only. Within 30 days: Conduct forensic review of FTP server logs and session files for indicators of exploitation, verify integrity of transferred files, and implement network segmentation to limit FTP server exposure.

Wing Ftp Server EUVD-2025-21009

Q: Which versions of Wing Ftp Server are affected by EUVD-2025-21009?

Wing FTP Server versions prior to 7.4.4 contain a critical unauthenticated remote code execution vulnerability (CVSS 10.0) that is actively being exploited in the wild.. A patch is available.

| CVE-2025-47812 CRITICAL

Improper Neutralization of Null Byte or NUL Character (CWE-158)

2025-07-10 cve@mitre.org

Privilege Escalation RCE Code Injection Ftp Wing Ftp Server Wftpserver

10.0

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-158 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Metacharacter neutralization
Impact	CVSS 10.0 (Critical). EPSS 92.7% — near-certain exploitation. KEV-listed — actively exploited. Public PoC available. Unauthenticated. Root/SYSTEM code execution guaranteed. Single HTTP request exploitation. FTP servers often accessible from internet.
Exploit ScenarioDerived	An attacker sends a single crafted HTTP request to the Wing FTP Server web interface containing a null byte followed by Lua code. The server writes this to a session file. When the Lua engine processes the session file, the injected code executes as root/SYSTEM. The attacker gains: full server access, access to all FTP user data and credentials, the ability to serve malicious files to FTP clients, and a persistent foothold for further attacks on the internal network.

Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.

Exploited in the wild (CISA KEV) Patch available 92.7% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 16, 2026

Wing FTP Server before 7.4.4 contains a critical remote code execution vulnerability (CVE-2025-47812, CVSS 10.0) through null byte injection in user/admin web interfaces that enables arbitrary Lua code execution in session files. With EPSS 92.7% and KEV listing, this vulnerability guarantees unauthenticated root/SYSTEM code execution on affected servers, as the FTP service runs with maximum privileges by default.

Earlier versions of this analysis (1)

v1 Mar 16, 2026 - 06:52 CVSS 10.0

Wing FTP Server's web interfaces mishandle null bytes (CWE-158), enabling injection of arbitrary Lua code into user session files. When these session files are loaded by the Lua-based FTP server, the injected code executes with root/SYSTEM privileges.

RemediationAI

Upgrade Wing FTP Server to 7.4.4+ immediately. If unable to upgrade, restrict web interface access to trusted IPs. Do NOT run Wing FTP as root/SYSTEM if possible. Audit FTP server for unauthorized access and file modifications.

Affected VersionsENISA

Wing FTP Server 0 <7.4.4

Affected Packages

euvd wing_ftp_server fix: 7.4.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Wing FTP Server uses Lua for its scripting engine and stores session data in Lua-format files. The web interfaces fail to reject or properly handle null bytes ('\0') in input, allowing attackers to truncate strings and inject arbitrary Lua code into session files. When the FTP server loads these session files, the Lua interpreter executes the injected code. Since Wing FTP typically runs as root (Linux) or SYSTEM (Windows), this provides maximum-privilege code execution.

Know when Wing Ftp Server gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

7.4.4

Added to CISA KEV

Nov 05, 2025 - 19:26 cisa

CISA KEV

PoC Detected

Nov 05, 2025 - 19:26 vuln.today

Public exploit code

CVE Published

Jul 10, 2025 - 17:15 nvd

CRITICAL 10.0

DescriptionCVE.org

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.

Executive ViewAI

Why It Matters

Wing FTP Server versions prior to 7.4.4 contain a critical unauthenticated remote code execution vulnerability (CVSS 10.0) that is actively being exploited in the wild. An attacker can execute arbitrary code with root/SYSTEM privileges on affected FTP servers without requiring authentication, directly compromising file integrity, confidentiality, and availability across your organization's file transfer infrastructure.

Business Impact: Severe

Compensating Controls

Apply vendor patch to Wing FTP Server version 7.4.4 or later immediately. If patching is delayed, restrict network access to FTP web interfaces to trusted administrator IPs only, disable the web interface entirely if not required, and monitor all FTP authentication and session activity for anomalous Lua code execution patterns.

Threat Intelligence Overview

Threat Score

7.8/10

Composite threat intelligence

EPSS Score

92.7%

Top 0% exploitable

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

CISA KEV

EPSS POC (3)

Exploit-DB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV Yes

Public POC Yes

EPSS 92.7%

Patch available Yes

Active threat Yes

Deciding rule

In CISA KEV with patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Immediate

Exploitation· derived

Active

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

228

Low Medium High Critical

KEV: +50

EPSS: +93

CVSS: +50

PoC: +20

Weaponized: +15

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.