A medium-severity CVSS score of 4.3 might not trigger alarm bells on its own. Howerver, active exploitation changes how organizations should assess and respond to the risk.
This article covers what the vulnerability does, which versions are affected, how attackers use it, and the steps to detect and remediate it across your environment.
What is CVE-2025-47813?
CVE-2025-47813 is an information disclosure vulnerability in Wing FTP Server, a file transfer application with over 10,000 customers worldwide. The flaw lives in the loginok.html page, which doesn't properly handle oversized values in the UID cookie.
When an authenticated user sends a request with an excessively long UID cookie value, the server throws an error that reveals the full local installation path of the application. This type of flaw falls under path disclosure.
On its own, it doesn't hand attackers direct control of a system. But the information it leaks becomes valuable reconnaissance for planning follow-on attacks.
- Vulnerability type: Information disclosure (path disclosure)
- Affected component:
loginok.html - Root cause: Improper input validation on the UID cookie
- Information exposed: Full file system path of the Wing FTP Server installation
CVSS score and severity rating
The Common Vulnerability Scoring System (CVSS) provides a standardized framework for rating vulnerability severity. CVE-2025-47813 carries a CVSS base score of 4.3, placing it in the medium severity range.
| Metric | Value |
|---|---|
| CVSS base score | 4.3 (Medium) |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
A medium score might seem less urgent than critical vulnerabilities. But here's the catch: CISA doesn't add vulnerabilities to the KEV catalog based on CVSS scores alone.
Effective threat and vulnerability management considers active exploitation signals, and the KEV listing confirms that attackers are exploiting this flaw, which changes the risk calculus entirely.
Affected Wing FTP Server versions
Every version of Wing FTP Server released before 7.4.4 is vulnerable to CVE-2025-47813. The vendor addressed the issue in version 7.4.4, which corrects the improper handling of oversized cookie values.
- Vulnerable: All versions prior to 7.4.4
- Patched: Version 7.4.4 and later
- Platforms: Windows, Linux, and macOS deployments are all affected
If you're running Wing FTP Server in your environment, the first step is confirming which version is installed. Organizations with incomplete software inventories often discover vulnerable instances they didn't know existed.
Why CISA added this vulnerability to the KEV catalog
CISA's Known Exploited Vulnerabilities catalog isn't a list of theoretical risks. CISA adds vulnerabilities to the KEV catalog based on three criteria, including reliable evidence that the vulnerability has been actively exploited. When a CVE appears in KEV, it indicates verified exploitation activity and an accelerated need to remediate.
Evidence of active exploitation
The KEV listing for CVE-2025-47813 confirms that attackers are actively targeting this vulnerability. While specific attack details aren't always published, the catalog entry signals that exploitation has moved beyond proof-of-concept into operational use.
Federal agency remediation deadline
Under Binding Operational Directive (BOD) 22-01, U.S. Federal Civilian Executive Branch agencies are required to remediate KEV-listed vulnerabilities by a specified deadline. For CVE-2025-47813, that deadline is March 30, 2026.
Implications for private sector organizations
BOD 22-01 applies only to federal agencies. But the KEV catalog has become a de facto priority list for organizations across sectors. If CISA confirms active exploitation, treating the federal deadline as your own target date is a reasonable approach to risk and vulnerability management.
How attackers exploit this vulnerability
The exploitation process for CVE-2025-47813 is straightforward for anyone with authenticated access to the server.
The UID cookie attack vector
An attacker crafts an HTTP request to the Wing FTP Server and manipulates the UID cookie, setting its value to an excessively long string. When the server attempts to process this malformed input, it fails and returns an error message. That error includes the full file system path where Wing FTP Server is installed.
How path disclosure enables lateral movement
Knowing the exact installation path gives attackers a map of the target system, enabling the kind of lateral movement in cyberattacks that turns a medium-severity flow into a serious breach. With this information, attackers can better understand the target environment and support follow-on exploitation, including chaining with other Wing FTP Server flaws.
Path disclosure vulnerabilities are often stepping stones. They provide the reconnaissance attackers need to escalate privileges or move laterally within a network.
Observed attack patterns
Information disclosure flaws like this one typically appear early in an attack chain. Attackers use the leaked path information to refine their approach, combining it with other vulnerabilities, including a related CVSS 10.0 RCE flaw, to achieve more damaging outcomes.
How to detect CVE-2025-47813 in your environment
Finding vulnerable instances requires a vulnerability assessment built on accurate, up-to-date visibility into the software running across your endpoints.
Discovering Wing FTP Server installations
Many organizations struggle with incomplete software inventories. Shadow IT, forgotten test servers, and decentralized deployments can all hide vulnerable installations. Real-time endpoint visibility helps surface every instance of Wing FTP Server, regardless of where it's running.
Identifying vulnerable versions
Once you've located all installations, check the version numbers. Any instance running a version prior to 7.4.4 is vulnerable. Point-in-time scans can miss devices that are offline or intermittently connected, so continuous monitoring provides a more accurate picture.
Threat hunting for indicators of compromise
To determine whether exploitation has already occurred, look for unusually long or malformed UID cookie values in server logs, spikes in error messages related to cookie processing, and follow-on reconnaissance activity from IP addresses that triggered such errors.
Because this is an information disclosure flaw, indicators may be subtle. Correlating log data with other suspicious activity through proactive threat hunting can help identify potential compromise.
Remediation steps
Follow this 4‑step sequence to address CVE‑2025‑47813 in your environment:
1. Inventory all affected systems: Start with a complete, real-time inventory of all endpoints running Wing FTP Server. Include on-premises systems, remote devices, and any instances in cloud environments.
2. Upgrade to the fixed version: Update Wing FTP Server to version 7.4.4 or later, as documented in the official CVE record and third‑party advisories.
3. Validate successful remediation: After deployment, re‑scan all systems to confirm they’re running the fixed version. Remediation isn’t complete until verification confirms no vulnerable instances remain.
4. Implement continuous monitoring: A one-time fix isn't enough. New installations, system rollbacks, or restored backups can reintroduce the vulnerability. Continuous monitoring catches version drift before it reintroduces a security gap.
Compensating controls when remediation isn't immediately possible
Sometimes operational constraints delay remediation. In those cases, compensating controls can reduce risk while you work toward a full fix.
Network segmentation and access restrictions
Limit network access to the Wing FTP Server. Restrict connections to trusted IP addresses or require VPN access. Reducing the attack surface prevents unauthorized users from reaching the server in the first place.
Enhanced logging and alerting
Increase logging verbosity on the Wing FTP Server and configure your SIEM to alert on suspicious patterns. Create rules that flag requests with unusually large cookie values.
Application control policies
Web application firewall (WAF) rules can inspect incoming requests and block those with oversized UID cookies. This provides a defensive layer while remediation is in progress.
How to validate successful remediation
Verification is the step that often gets skipped. After remediation, run discovery scans to confirm all previously vulnerable instances now report version 7.4.4 or later. Document this validation for compliance and audit purposes.
Don't wait for your next scheduled vulnerability scan. Run validation immediately after the upgrade cycle to confirm success and close the loop.
Frequently asked questions about CVE-2025-47813
What is the CWE classification for this vulnerability?
CVE-2025-47813 is classified under CWE-209: Generation of Error Message Containing Sensitive Information. The Common Weakness Enumeration (CWE) is a community-developed catalog of software and hardware weakness types.
Can this vulnerability be exploited without authentication?
No. Exploiting CVE-2025-47813 requires low-level authenticated access to the server. An attacker without credentials can't trigger the path disclosure.
Does this affect Wing FTP Server on all operating systems?
Yes. The vulnerability exists in the application code, not the underlying platform. Windows, Linux, and macOS deployments are all affected.
What if we find evidence of exploitation?
Trigger your incident response plan immediately. Isolate affected systems, preserve logs and system images for forensic analysis, and report the incident if required by policy or regulation.
How does this differ from other Wing FTP Server vulnerabilities?
CVE-2025-47813 is specifically an information disclosure flaw. Its direct impact is leaking system information rather than enabling remote code execution or privilege escalation. However, the leaked information often enables those more severe attacks as part of a broader attack chain.
Effective response to threats like CVE-2025-47813 depends on speed and accuracy. Organizations with real-time endpoint visibility can identify every vulnerable installation in seconds, deploy fixes at scale, and validate remediation immediately.
Tanium is built to help organizations evolve their approach to modern exposure management by combining real-time endpoint intelligence with integrated vulnerability and remediation workflows within a single platform. This helps reduce exposure windows and enables teams to respond with confidence. Instead of waiting days or weeks for scan results, teams can act quickly and verify outcomes in real time.
Schedule a free, customized demo to see how Tanium supports faster CVE response.