Improper Null Byte Handling in Wing FTP Server (CVE‑2025‑47812) Enables Arbitrary Code Execution
What It Is — Wing FTP Server fails to properly neutralize a null‑byte (NUL) character in session‑file handling. An attacker can inject arbitrary Lua code that is written to a user‑session file and later executed by the FTP service.
Exploitability — The flaw is rated CVSS 9.8 (Critical). No public exploit has been observed, but the vulnerability is trivial to weaponise once a target is reachable.
Affected Products — All currently supported releases of Wing FTP Server (the vendor’s FTP/FTPS/SFTP server product) prior to the forthcoming security patch.
Why It Matters for Trust & Control Assurance
- Input validation & secure coding – The issue highlights a missing control around sanitising user‑supplied data, a core control objective that maps to many frameworks (e.g., NIST CSF 2.0 “Protect – Data Security”).
- Continuous control monitoring – Detecting unexpected Lua code or abnormal command execution requires logging and real‑time monitoring, providing defensible evidence for auditors.
- Defensible audit trail – Demonstrating that you have patched, hardened configuration, and can prove the absence of malicious code satisfies due‑diligence expectations from enterprise buyers.
Recommended Actions
- Apply the vendor‑released patch for CVE‑2025‑47812 immediately.
- Review FTP server configuration to enforce least‑privilege (run the service under a non‑root account where possible).
- Enable detailed command‑execution logging and integrate logs into a SIEM for continuous monitoring.
- Conduct a code‑review of any custom Lua scripts or extensions to ensure proper input sanitisation.
- Update your control‑mapping inventory to reflect the “Input Validation” control and capture remediation evidence.
Source: CISA KEV – CVE‑2025‑47812