CVE-2025-47811
📋 TL;DR
Wing FTP Server versions through 7.4.4 run the administrative web interface with root/SYSTEM privileges by default. This allows authenticated administrative users to execute arbitrary system commands through legitimate web interface features, potentially leading to privilege escalation if those users aren't system administrators. Organizations running vulnerable versions with the default configuration are affected.
💻 Affected Systems
- Wing FTP Server
📦 What is this software?
Wing Ftp Server by Wftpserver
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root/SYSTEM access, allowing attackers to install persistent malware, steal sensitive data, or pivot to other systems.
Likely Case
Privilege escalation where authenticated administrative users gain full system control beyond their intended permissions.
If Mitigated
Limited impact if administrative users are trusted system administrators and proper network segmentation is in place.
🎯 Exploit Status
Exploitation requires administrative access to the web interface. CVE-2025-47812 can be leveraged if privileged application role isn't available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: https://www.wftpserver.com
Restart Required: No
Instructions:
No official patch available as vendor considers this behavior acceptable. Consider workarounds or alternative solutions.
🔧 Temporary Workarounds
Run Wing FTP Server with reduced privileges
allConfigure Wing FTP Server to run as a non-privileged user instead of root/SYSTEM
# Linux: Create dedicated user and run service as that user
# Windows: Configure service to run as limited user account
Restrict administrative web interface access
allLimit access to the administrative interface using firewall rules and network segmentation
# Linux: iptables -A INPUT -p tcp --dport 5466 -s trusted_ip -j ACCEPT
# Windows: netsh advfirewall firewall add rule name="Block Wing FTP Admin" dir=in action=block protocol=TCP localport=5466
🧯 If You Can't Patch
- Implement strict access controls to ensure only trusted system administrators have administrative access to the web interface
- Monitor administrative interface logs for unusual command execution patterns and implement alerting
🔍 How to Verify
Check if Vulnerable:
Check Wing FTP Server version and verify if administrative interface runs with elevated privileges. Review service configuration and user context.Check Version:
# Windows: Check program version in About dialog
# Linux: Check version in web interface or installation directoryVerify Fix Applied:
Verify Wing FTP Server is running as non-privileged user and administrative interface access is properly restricted.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution through web console
- Task scheduler entries with suspicious commands
- Multiple failed login attempts to administrative interface
Network Indicators:
- Unusual traffic to port 5466 from unexpected sources
- Command execution patterns in HTTP requests to administrative interface
SIEM Query:
source="wing_ftp.log" AND (event="command_execution" OR event="task_scheduler") AND command="*"