wftpserver Wing FTP Server up to 7.4.4 Administrative Web Interface privilege defined with unsafe actions ⚔ [Disputed]

Summaryinfo

A vulnerability identified as problematic has been detected in wftpserver Wing FTP Server up to 7.4.4. This impacts an unknown function of the component Administrative Web Interface. Performing a manipulation results in privilege defined with unsafe actions. This vulnerability is reported as CVE-2025-47811. The attack is possible to be carried out remotely. No exploit exists. The existence of this vulnerability is still disputed at present.

Detailsinfo

A vulnerability classified as problematic has been found in wftpserver Wing FTP Server up to 7.4.4. This affects some unknown functionality of the component Administrative Web Interface. The manipulation with an unknown input leads to a privilege defined with unsafe actions vulnerability. CWE is classifying the issue as CWE-267. A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity. This is going to have an impact on integrity. The summary by CVE is:

In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default. The web application itself offers several legitimate ways to execute arbitrary system commands (i.e., through the web console or the task scheduler), and they are automatically executed in the highest possible privilege context. Because administrative users of the web interface are not necessarily also system administrators, one might argue that this is a privilege escalation. (If a privileged application role is not available to an attacker, CVE-2025-47812 can be leveraged.) NOTE: the vendor reportedly considers this behavior "fine to keep."

This vulnerability is uniquely identified as CVE-2025-47811 since 05/10/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. Additional levels of successful authentication are required for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-21021). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• File Transfer Software

Vendor

• wftpserver

Name

• Wing FTP Server

Version

• 7.4.0
• 7.4.1
• 7.4.2
• 7.4.3
• 7.4.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion