CVE-2022-50934
Wing FTP Server - Authenticated RCE
Description
Rejected reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.
INFO
Published Date :
Jan. 13, 2026, 11:15 p.m.
Last Modified :
Jan. 14, 2026, 7:16 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update Wing FTP Server to version 4.3.9 or later.
- Apply vendor-provided security patches.
- Review and restrict administrative access.
- Monitor for suspicious administrative activity.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2022-50934 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2022-50934 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Rejected by [email protected]
Jan. 14, 2026
Action Type Old Value New Value -
CVE Modified by [email protected]
Jan. 14, 2026
Action Type Old Value New Value Changed Description Wing FTP Server versions 4.3.8 and below contain an authenticated remote code execution vulnerability that allows attackers to execute arbitrary PowerShell commands through the admin interface. Attackers can leverage a crafted Lua script payload with base64-encoded PowerShell to establish a reverse TCP shell by authenticating and sending a malicious request to the admin panel. Rejected reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Removed CVSS V4.0 VulnCheck: AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Removed CVSS V3.1 VulnCheck: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Removed CWE VulnCheck: CWE-94 Removed Reference VulnCheck: https://www.exploit-db.com/exploits/50720 Removed Reference VulnCheck: https://www.vulncheck.com/advisories/wing-ftp-server-authenticated-rce Removed Reference VulnCheck: https://www.wftpserver.com/ -
New CVE Received by [email protected]
Jan. 13, 2026
Action Type Old Value New Value Added Description Wing FTP Server versions 4.3.8 and below contain an authenticated remote code execution vulnerability that allows attackers to execute arbitrary PowerShell commands through the admin interface. Attackers can leverage a crafted Lua script payload with base64-encoded PowerShell to establish a reverse TCP shell by authenticating and sending a malicious request to the admin panel. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-94 Added Reference https://www.exploit-db.com/exploits/50720 Added Reference https://www.vulncheck.com/advisories/wing-ftp-server-authenticated-rce Added Reference https://www.wftpserver.com/