Update your settings

Hackers Exploit Wing FTP Server RCE Flaw to Gain Full Control

A critical security vulnerability identified as CVE-2025-47812 is now under active exploitation, and it’s putting thousands of servers at risk. This Wing FTP Server RCE flaw enables unauthenticated attackers to execute arbitrary code with system-level privileges—essentially giving them full control of compromised servers. Despite a fix being available well before public disclosure, many servers remained unpatched, allowing threat actors to strike swiftly once the flaw became widely known.

How the Wing FTP Server RCE Flaw Works

This exploit stems from a null byte injection vulnerability found in the username field of Wing FTP Server. It allows attackers to bypass authentication mechanisms and inject Lua code, which can then be executed remotely. According to researchers at Huntress, exploitation of the flaw began just one day after technical details were released on June 30, 2025. The bug allows unauthenticated remote code execution (RCE), letting attackers execute code as root or SYSTEM, depending on the server's OS.

Real-World Impact of the Wing FTP Server RCE Flaw

The implications of this attack are severe. Once attackers gain root access through the Wing FTP Server RCE flaw, they can install malware, exfiltrate data, or even move laterally within a network to target other critical systems. Security teams have observed widespread scanning activity and confirmed successful breaches, especially among organizations slow to apply security updates. Since Wing FTP is used in industries ranging from finance to healthcare, the ripple effect of this flaw could be substantial.

How to Protect Your Server from the RCE Flaw

Server administrators using Wing FTP are urged to patch immediately by upgrading to the latest secure version. It's also crucial to review logs, check for unauthorized access, and implement network segmentation to limit damage in case of compromise. Enabling multi-factor authentication (MFA) and monitoring for suspicious Lua script activity can provide additional layers of defense. Organizations should treat this as a high-priority threat and act now to safeguard critical infrastructure from active exploitation.