FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations
FBI and Lumen disrupted QTFY's QScan and QTRouter botnet platforms used by Chinese state-sponsored hackers to conceal intrusions into U.S. agencies.
78
CVE-2025-31161
Authentication Bypass in CrushFTP File Transfer Servers (CVE-2025-31161)
CISA: CrushFTP Authentication Bypass Vulnerability
- CVSS 3.1
- 9.8 critical
- EPSS
- 100%p100
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CrushFTP contains an authentication bypass (CWE-305) in its handling of the HTTP authorization header, allowing crafted header values to grant access without valid credentials. A remote, unauthenticated attacker who can reach the server's HTTP/HTTPS interface can use this flaw to authenticate as any known or guessable account, such as the built-in crushadmin user. With administrative access, the attacker can typically achieve full compromise of the file-transfer server, including access to hosted files and user accounts. Any organization running CrushFTP is affected, with internet-exposed instances at the highest risk. The flaw is being actively exploited: it was added to CISA's KEV on 2025-04-07 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days.
What to do: Upgrade to the vendor's fixed releases (10.8.0 for the 10.x line and 11.3.1 for the 11.x line, per vendor advisories); federal agencies must follow BOD 22-01 timelines or discontinue use if mitigations are unavailable. Until patched, restrict network access to the CrushFTP HTTP/HTTPS interface and audit authentication logs for unexpected logins to privileged accounts such as crushadmin. Given confirmed ransomware use, treat internet-exposed instances as actively targeted and verify there are no signs of prior compromise after patching.
| Product | Affected |
|---|---|
| CrushFTP | — |
Estimated exposure
moderate≈5,000–10,000 internet-exposed CrushFTP servers (public scan counts), with additional uncounted internal enterprise deployments — Public internet-wide scan services showed several thousand exposed CrushFTP instances at the time of the April 2025 KEV listing, and enterprise file-transfer deployments commonly sit behind the firewall as well, so total installations…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account.
KEVCISA Known Exploited Vulnerability
- Affected
- CrushFTP CrushFTP
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Due date
- Ransomware use
- Known
In the news
13 storiesRisky Bulletin: Authorities dismantle KillSec group, arrest members across Europe
European police dismantled the KillSec ransomware gang, arresting three suspects including a 16-year-old administrator.
76
Storm-1175 Replaces Medusa With New StormEncryptor Ransomware
Microsoft reports China-linked ransomware group Storm-1175 switched from Medusa to a new C++ strain, StormEncryptor, likely exploiting N-able flaw CVE-2026-18577.
62
60
Hackers Exploit Critical CrushFTP Flaw to Gain Admin Access on Unpatched Servers
60
60
60
60
CISA Adds CrushFTP Vulnerability to KEV Catalog Following Confirmed Active Exploitation
60
CISA Warns of CrushFTP Vulnerability Exploitation in the Wild
60
New Security Flaws Found in VMware Tools and CrushFTP — High Risk, PoC Released
60
60
60