Information Disclosure in Wing FTP Server (CVE‑2025‑47813) – Sensitive Data Leaked via Error Messages
What It Is – Wing FTP Server improperly includes sensitive information in error‑message payloads when a specially crafted long value is supplied in the UID cookie. The flaw can be triggered remotely without authentication.
Exploitability – Publicly disclosed; proof‑of‑concept code is available on public repositories. The CISA KEV listing indicates active exploitation in the wild. CVSS v3.1 base score: 7.8 (High).
Affected Products – Wing FTP Server (all versions prior to the vendor‑released patch, see CISA advisory).
Why It Matters for Trust & Control Assurance
- Data‑Protection Controls – The vulnerability demonstrates a gap in safeguarding confidential information at the application layer, a core control objective for any audit framework.
- Logging & Monitoring – Without proper log sanitisation, organizations may lack defensible evidence that sensitive data was not exposed, weakening audit readiness.
- Continuous Assurance – Demonstrating that error handling is hardened and evidence is collected satisfies multiple framework requirements (e.g., NIST CSF “Protect” and ISO 27001 “Asset Management”).
Recommended Actions
- Apply the vendor’s security patch immediately.
- Review and harden all error‑handling routines to strip or mask sensitive fields before they are sent to clients.
- Enable detailed logging of FTP server responses and retain logs for at least 90 days to provide audit evidence of remediation.
- Update your control‑mapping inventory to reflect the new mitigation and capture evidence for compliance reviews.
Source: CISA KEV – CVE‑2025‑47813