Privilege escalation in Wftpserver Wing FTP Server
CVE-2025-47811
In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default. The web application itself offers several legitimate ways to execute arbitrary system commands (i.e., through the web console or the task scheduler), and they are automatically executed in the highest possible privilege context. Because administrative users of the web interface are not necessarily also system administrators, one might argue that this is a privilege escalation. (If a privileged application role is not available to an attacker, CVE-2025-47812 can be leveraged.) NOTE: the vendor reportedly considers this behavior "fine to keep."
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.048 (91.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 92nd percentile — 91.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.041 · newest: 0.048 · change: +0.007
Affected products
- Wftpserver Wing FTP Server — versions 0
- Wftpserver Wing FTP Server
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.wftpserver.com (Broken Link)
- www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/ (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-47811?
- CVE-2025-47811 is a medium-severity vulnerability in Wftpserver Wing FTP Server, classified under Privilege Defined With Unsafe Actions. CVSS score: 4.1/10. Published 2025-07-10.
- How severe is CVE-2025-47811?
- Medium severity. CVSS v3 base score is 4.1 out of 10.
- Is CVE-2025-47811 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.