Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. Attackers can leverage the console to send POST requests with malicious commands that trigger operating system execution through the os.execute() function.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
[CVE-2020-37032: HIGH] Wing FTP Server 6.3.8 is vulnerable to remote code execution via its Lua-based web console. Authenticated users can exploit the flaw to execute system commands.#cve,CVE-2020-37032,#cybersecurity https://cvefind.com/CVE-2020-37032
Post summary
Wing FTP Server 6.3.8 allows authenticated users to exploit a Lua-based web console for remote code execution, enabling arbitrary system command execution.
CVE-2020-37032 Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. Attacker… https://www.cve.org/CVERecord?id=CVE-2020-37032
Post summary
The tweet announces that Wing FTP Server 6.3.8 contains a remote code execution vulnerability via its Lua-based web console, enabling authenticated users to run system commands, with no PoC, exploit, patch, or active exploitation mentioned.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wftpserver | wing_ftp_server | 6.3.8 | - | - |