Actively exploited in the wild
Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability
Progress - WS_FTP Server · Listed in the CISA KEV since 2023-10-05. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-40044
CriticalCVSS 10.0KEVSummary
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
Risk Assessment
An unauthenticated attacker can execute arbitrary commands on the WS_FTP server, potentially leading to full system compromise and confidentiality breach of transferred files.
Recommendation
Upgrade WS_FTP Server to version 8.7.4 or 8.8.2 (or later). Restrict access to the Ad Hoc Transfer module to trusted users only.
Other vulnerabilities in WS_FTP Server
Original NVD description (English source)
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.