CVE-2019-25267: 
Wing FTP Server vulnerability analysis and mitigation

CVE-2019-25267 is an unquoted service path vulnerability in Wing FTP Server version 6.0.7 that allows local attackers with low privileges to execute arbitrary code with LocalSystem (SYSTEM-level) permissions. The vulnerability was published on February 5, 2026, and affects only the specific version 6.0.7 of the Wing FTP Server software on Windows. It carries a CVSS v3.1 base score of 7.8 (High) (Feedly, Exploit-DB).

The root cause is classified as CWE-428 (Unquoted Search Path or Element). On Windows, when a service binary path contains spaces and is not enclosed in quotation marks, the Windows Service Control Manager may attempt to execute intermediate path components as executables. A local attacker with write access to a directory in the unquoted service path can place a malicious executable at a location that Windows resolves before the legitimate binary, causing it to be executed with LocalSystem privileges when the Wing FTP Server service starts or restarts. No authentication bypass or network access is required — only local user-level access to the host (Feedly, Exploit-DB).

Successful exploitation results in complete system compromise, granting the attacker LocalSystem-level privileges — the highest privilege level on a Windows host. This enables full confidentiality, integrity, and availability impact: the attacker can read or exfiltrate sensitive data, modify or destroy files, disable services, install persistent backdoors, and use the compromised host as a pivot point for lateral movement within the network (Feedly).

A proof-of-concept exploit is publicly available on Exploit-DB (exploit ID 47818), lowering the barrier for exploitation. However, there is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.011% (0.000110), reflecting a low probability of near-term exploitation. Exploitation requires local access to the target system, which limits the attack surface compared to remotely exploitable vulnerabilities (Feedly, Exploit-DB).

1. Reconnaissance: Identify Windows hosts running Wing FTP Server 6.0.7 as a Windows service. Confirm the service binary path is unquoted by running sc qc WingFTPServer or querying the registry at HKLM\SYSTEM\CurrentControlSet\Services\WingFTPServer and checking the ImagePath value for spaces without surrounding quotes.
2. Identify writable directory: Determine which directory in the unquoted path is writable by the attacker's low-privileged account. For example, if the path is C:\Program Files\Wing FTP Server\WingFTPServer.exe, Windows may attempt to execute C:\Program.exe or C:\Program Files\Wing.exe first.
3. Craft malicious executable: Create a malicious executable (e.g., a reverse shell or privilege escalation payload) and name it to match the intermediate path component Windows will attempt to resolve (e.g., Wing.exe or Program.exe).
4. Place the executable: Copy the malicious executable into the writable directory identified in step 2.
5. Trigger service restart: Wait for or trigger a restart of the Wing FTP Server service (e.g., via system reboot, service crash, or if the attacker has permissions to restart services). Windows will execute the malicious binary with LocalSystem privileges instead of the legitimate FTP server binary.
6. Achieve SYSTEM access: The malicious payload executes as LocalSystem, granting full control of the host (Exploit-DB, Feedly).

• Registry: Unquoted ImagePath value under HKLM\SYSTEM\CurrentControlSet\Services\WingFTPServer containing spaces without surrounding double quotes.
• File System: Unexpected executables placed in directories along the Wing FTP Server installation path (e.g., C:\Program.exe, C:\Program Files\Wing.exe, or similar intermediate path components); new or modified files in FTP service directories with recent timestamps.
• Process: Unusual processes spawned as children of the Windows Service Control Manager (services.exe) with SYSTEM privileges that are not the legitimate WingFTPServer.exe; unexpected cmd.exe, powershell.exe, or network tools running as SYSTEM.
• Logs: Windows Event Log entries (Event ID 7036 or 7045) showing Wing FTP Server service state changes at unexpected times; Security event logs showing new process creation under the SYSTEM account from non-standard paths.

No official patch information is currently confirmed for Wing FTP Server 6.0.7 — organizations should contact the vendor (wftpserver) directly to determine patch availability and upgrade paths. As interim mitigations: (1) enclose the Wing FTP Server service binary path in double quotes in the Windows registry (HKLM\SYSTEM\CurrentControlSet\Services\WingFTPServer\ImagePath); (2) restrict write permissions on all directories in the service binary path to prevent unauthorized file placement; (3) enforce the principle of least privilege for local user accounts on hosts running Wing FTP Server; (4) implement file integrity monitoring on the service binary path and surrounding directories; and (5) disable or restrict FTP services if not operationally required (Feedly).