CVE-2020-37032: 
Wing FTP Server vulnerability analysis and mitigation

CVE-2020-37032 is a remote code execution (RCE) vulnerability in Wing FTP Server 6.3.8 that allows authenticated users to execute arbitrary operating system commands via the server's Lua-based web console. Attackers exploit the vulnerability by sending malicious POST requests to the console, which trigger OS command execution through Lua's os.execute() function. The vulnerability was formally published on January 30, 2026, and is classified as High severity with a CVSS v3.1 base score of 8.8 (Feedly, VulnCheck Advisory).

The root cause is improper neutralization of special elements used in OS commands (CWE-78 — OS Command Injection). The Wing FTP Server 6.3.8 web console exposes a Lua scripting interface that, when accessed by an authenticated user, allows direct invocation of os.execute() with attacker-controlled input. An attacker with valid credentials can craft a POST request to the web console endpoint containing a malicious Lua snippet that passes arbitrary shell commands to the underlying operating system without adequate sanitization or sandboxing. A public proof-of-concept exploit is available on Exploit-DB (EDB-ID 48676) (Exploit-DB, VulnCheck Advisory).

Successful exploitation grants an authenticated attacker full remote code execution on the host running Wing FTP Server, resulting in high confidentiality, integrity, and availability impact. An attacker can read or exfiltrate sensitive files managed by the FTP server, modify server configurations or hosted data, and potentially disrupt service availability through resource exhaustion or system shutdown. Because the FTP service account may have broad filesystem access, exploitation could facilitate lateral movement within the network or privilege escalation depending on the server's configuration (Feedly, VulnCheck Advisory).

A public proof-of-concept exploit is available on Exploit-DB (EDB-ID 48676), lowering the barrier for exploitation (Exploit-DB). As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and no threat actor attribution has been published. The EPSS score is approximately 0.202%, indicating a relatively low (but non-negligible) probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No patch information is available from the vendor for version 6.3.8 (Feedly).

1. Reconnaissance: Identify internet-facing Wing FTP Server instances running version 6.3.8 using tools such as Shodan or Censys, searching for the Wing FTP web management interface (typically on port 5466 or a configured HTTP/HTTPS port).
2. Obtain credentials: Acquire valid credentials for the Wing FTP Server web console through phishing, credential stuffing, brute force, or insider access — exploitation requires authentication.
3. Access the Lua web console: Log in to the Wing FTP Server web administration interface and navigate to the built-in Lua scripting/console feature.
4. Craft malicious POST request: Send a POST request to the console endpoint containing a Lua payload that calls os.execute() with the desired OS command, e.g., os.execute('id') or a reverse shell command.
5. Achieve code execution: The server executes the injected OS command in the context of the FTP service account, enabling data exfiltration, persistence mechanisms, or further lateral movement (Exploit-DB, VulnCheck Advisory).

• Network: Unusual or unexpected POST requests to the Wing FTP Server web console endpoint from non-administrative IP addresses; outbound connections from the FTP server process to unknown external hosts (potential reverse shell activity).
• Logs: Wing FTP Server access logs showing POST requests to the Lua console interface with suspicious or encoded payloads; authentication events from unfamiliar source IPs followed immediately by console access.
• Process: Unexpected child processes spawned by the Wing FTP Server process (e.g., cmd.exe, powershell.exe, /bin/sh, bash, curl, wget, nc) indicating OS command execution.
• File System: New or modified files in the Wing FTP Server installation directory or system directories created by the FTP service account; presence of web shells, scripts, or unauthorized executables.

No official patch from the vendor has been confirmed for Wing FTP Server 6.3.8. As immediate mitigations, administrators should restrict network access to the Wing FTP Server web console to trusted IP addresses only using firewall rules or network ACLs. If the Lua-based web console is not operationally required, it should be disabled entirely. Apply the principle of least privilege to the FTP service account to limit the blast radius of any exploitation. Monitor FTP server logs for suspicious POST requests to the console endpoint and consider upgrading to a newer version of Wing FTP Server if one is available from the vendor (VulnCheck Advisory, Wing FTP Server).