Vulnerabilities - CISA Flags Wing FTP Server Flaw Exploited

The Flaw

CISA has raised alarms about a serious vulnerability in Wing FTP Server, tracked as CVE-2025-47813. This flaw allows attackers with low privileges to uncover the full installation path of the application on unpatched servers. It stems from an error message that inadvertently reveals sensitive information when a long value is used in the UID cookie. This vulnerability is particularly dangerous because it can be exploited in conjunction with another critical flaw, CVE-2025-47812, which enables remote code execution (RCE).

The implications of this vulnerability are significant, especially given that Wing FTP Server is used by over 10,000 customers globally, including high-profile organizations like the U.S. Air Force and Sony. The potential for exploitation is high, as attackers have already begun leveraging this flaw in the wild, just one day after its technical details were disclosed.

What's at Risk

The risk associated with CVE-2025-47813 is compounded by its ability to be chained with the RCE vulnerability. If exploited, attackers could gain unauthorized access to sensitive data or even take control of the affected systems. This poses a substantial threat to federal agencies and private sector organizations alike. CISA has emphasized that this type of vulnerability is a common attack vector for malicious actors, highlighting the urgency for organizations to act swiftly.

Patch Status

CISA has mandated that Federal Civilian Executive Branch (FCEB) agencies secure their systems against this vulnerability within two weeks, in accordance with the November 2021 Binding Operational Directive (BOD) 22-01. The developers of Wing FTP Server released a patch in May 2025 that addresses this flaw, along with other critical vulnerabilities. However, many organizations may still be running outdated versions of the software, leaving them exposed.

Immediate Actions

Organizations using Wing FTP Server should take immediate action to mitigate the risks associated with CVE-2025-47813. CISA recommends applying the available patches as per vendor instructions. For those unable to implement mitigations, discontinuing the use of the product may be necessary. Additionally, organizations should monitor their systems for any signs of exploitation and remain vigilant against potential attacks. CISA's warning serves as a crucial reminder of the importance of maintaining up-to-date security practices and being proactive in addressing vulnerabilities.