What is CVE-2025-47811?
In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default. The web application itself offers several legitimate ways to execute arbitrary system commands (i.e., through the web console or the task scheduler), and they are automatically executed in the highest possible privilege context. Because administrative users of the web interface are not necessarily also system administrators, one might argue that this is a privilege escalation. (If a privileged application role is not available to an attacker, CVE-2025-47812 can be leveraged.) NOTE: the vendor reportedly considers this behavior "fine to keep."
The record classifies CVE-2025-47811 under weakness class CWE-267. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs high-privilege credentials, needs no user interaction. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 452 days ago.
Severity and exploitation probability
- CVSS v3.1 base score
- 4.1 — MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N - EPSS (FIRST)
- 0.0% probability of exploitation in the next 30 days, higher than 27.6% of all scored CVEs
- CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Threadlinqs priority
- 3.2/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- Published
- 2025-07-10, last modified 2025-07-17
Is CVE-2025-47811 being exploited?
It currently carries a trending score of 12 in the Threadlinqs vulnerability feed.
Affected products and versions
- Wftpserver: Wing Ftp Server
How to fix CVE-2025-47811
The record marks a vendor fix as available for CVE-2025-47811. No patch URL is recorded on this row, so the fixed version has to be read from the vendor advisory in the sources below.
Threat activity tracking CVE-2025-47811
No threat campaign in the Threadlinqs corpus currently references CVE-2025-47811, in its CVE list or as an indicator. The linkage is recomputed from the live corpus on every daily ingest, so this section fills in as soon as a tracked campaign cites the identifier.
Sources
Seeded from threadlinqs-intel and not yet processed by the Threadlinqs enrichment pipeline, so blank CVSS, EPSS or KEV fields above mean NOT MEASURED rather than measured-absent.