CVE-2025-47812Vulnerability
Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 15 months ago
CISA KEVAdded 14 Jul 2025
Fix due 4 Aug 2025
Used by ransomware: not knownCISA KEV catalogue
Fix due 4 Aug 2025
Used by ransomware: not knownCISA KEV catalogue
EPSS93.9%
higher than 99% of CVEsFIRST EPSS, as of 24 Oct 2026
higher than 99% of CVEsFIRST EPSS, as of 24 Oct 2026
What the reports say
1 report, newest first · the exact sentence from each-
Wing FTP Server RCE (CVE-2025-47812) Exploited in the Wild“Wing FTP Server RCE (CVE-2025-47812) Exploited in the Wild”
Indicators reported together
named in the same reports- 149.248.44[.]88in 1 report
- 123.123.123[.]123in 1 report
- hxxp://185.196.9[.]225:8080/EOp45eWLSp5G5Uwp_yOCiQin 1 report
- 185.196.9[.]225in 1 report
- hxxps://webhook[.]site/5d112487-6133-4942-ac87-3f473d44bd81in 1 report
- hxxps://pastebin[.]com/raw/vqqtr8mg&in 1 report
- hxxps://oooooooo11.screenconnect[.]com/bin/screenconnect.clientsetup.msi?ein 1 report
- 223.160.131[.]104in 1 report
- 103.88.141[.]42in 1 report
- 146.70.11[.]39in 1 report
- c637ec00bd22da45…d65e4f5698f4in 1 report
- hxxps://oooooooo11.screenconnect[.]com/bin/screenconnect.clientsetup.msiin 1 report
- f0fcc638cd93bdd6…17cb2f58d8acin 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.