CISA Warns - Actively Exploited Wing FTP Server Vulnerability
Basically, there's a serious flaw in Wing FTP Server that hackers are using to take control of systems.
CISA has issued a critical warning about a vulnerability in Wing FTP Server that's being actively exploited. This affects thousands of users globally. Immediate patching is essential to prevent potential data breaches and attacks.
The Flaw
CISA has issued a warning regarding a critical vulnerability in Wing FTP Server, identified as CVE-2025-47813. This flaw is particularly dangerous as it allows low-privileged attackers to discover the full local installation path of the software. This information can be exploited to launch remote code execution attacks, which could compromise the server and the data it manages.
This vulnerability is not standalone; it can be chained with another critical flaw, CVE-2025-47812, and an information disclosure vulnerability, CVE-2025-27889. Together, these vulnerabilities could allow attackers to steal user passwords and gain unauthorized access to sensitive information. With over 10,000 customers globally using Wing FTP Server, including major organizations, the potential impact is significant.
What's at Risk
The risk posed by CVE-2025-47813 is severe, especially for organizations that rely on Wing FTP Server for file transfers and storage. If exploited, attackers could execute arbitrary code on the server, leading to data breaches and loss of sensitive information. The fact that this vulnerability is actively being exploited means that the window for attacks is open, making immediate action crucial for all users.
Organizations that fail to patch this vulnerability not only risk data loss but also potential reputational damage and legal repercussions. The urgency of the situation is underscored by CISA's directive mandating federal agencies to apply mitigations within two weeks.
Patch Status
A patch for the vulnerability was released in version 7.4.4 of Wing FTP Server in May 2025. This update addresses CVE-2025-47813 effectively, but many organizations may still be operating on older versions. The proof-of-concept exploit code for this vulnerability was made public in June 2025, further increasing the urgency for organizations to update their systems.
CISA has added CVE-2025-47813 to its catalog of actively exploited vulnerabilities. While the directive primarily targets federal agencies, CISA strongly encourages all organizations, including those in the private sector, to patch their systems promptly.
Immediate Actions
Organizations using Wing FTP Server should take immediate steps to secure their systems. Here are the recommended actions:
- Update to the latest version (7.4.4 or higher) of Wing FTP Server.
- Review system configurations to ensure no unauthorized access has occurred.
- Monitor network traffic for any signs of exploitation attempts.
- Educate staff about the risks associated with unpatched vulnerabilities.
By taking these proactive measures, organizations can significantly reduce their risk of falling victim to attacks exploiting this critical vulnerability.
SC Media