TROYANOSYVIRUS
← Retour aux CVEs

CVE-2025-5196

MEDIUM
6.6

Description

A vulnerability has been found in Wing FTP Server up to 7.4.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Lua Admin Console. The manipulation leads to execution with unnecessary privileges. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 7.4.4 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains: "[W]e do not consider it as a security vulnerability, because the system admin in WingFTP has full permissions [...], but you can suggest the user run WingFTP service as Normal User rather than SYSTEM/Root, it will be safer."

Details CVE

Score CVSS v3.16.6
SeveriteMEDIUM
Vecteur CVSSCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Vecteur d'attaqueNETWORK
ComplexiteHIGH
Privileges requisHIGH
Interaction utilisateurNONE
Publie5/26/2025
Derniere modification7/2/2025
Sourcenvd
Observations honeypot0

Produits affectes

wftpserver:wing_ftp_server

Faiblesses (CWE)

CWE-250

References

https://github.com/Nouvexr/Wing-FTP-Server-7.4.4-RCE-Authenticated/blob/main/poc.txt(cna@vuldb.com)
https://vuldb.com/?ctiid.310279(cna@vuldb.com)
https://vuldb.com/?id.310279(cna@vuldb.com)
https://vuldb.com/?submit.584253(cna@vuldb.com)
https://www.wftpserver.com/serverhistory.htm(cna@vuldb.com)
https://github.com/Nouvexr/Wing-FTP-Server-7.4.4-RCE-Authenticated/blob/main/poc.txt(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.