Attackers are targeting CrushFTP vulnerability with public PoC (CVE-2025-2825)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-2825 | Rejected reason: DO NOT USE THIS CVE RECORD. Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2025-31161. Reason: This Record is a reservation duplicate of CVE-2025-31161. Notes: All CVE users should reference CVE-2025-31161 instead of this Record. All references and descriptions in this Record have been removed to prevent accidental usage. NVD description · AI analysis pending | — | — | — | — | ||
| CVE-2025-31161 | Authentication Bypass in CrushFTP File Transfer Servers (CVE-2025-31161) CrushFTP contains an authentication bypass (CWE-305) in its handling of the HTTP authorization header, allowing crafted header values to grant access without valid credentials. A remote, unauthenticated attacker who can reach the server's HTTP/HTTPS interface can use this flaw to authenticate as any known or guessable account, such as the built-in crushadmin user. With administrative access, the attacker can typically achieve full compromise of the file-transfer server, including access to hosted files and user accounts. Any organization running CrushFTP is affected, with internet-exposed instances at the highest risk. The flaw is being actively exploited: it was added to CISA's KEV on 2025-04-07 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. Do: Upgrade to the vendor's fixed releases (10.8.0 for the 10.x line and 11.3.1 for the 11.x line, per vendor advisories); federal agencies must follow BOD 22-01 timelines or discontinue use if mitigations are unavailable. Until patched, restrict network access to the CrushFTP HTTP/HTTPS interface and audit authentication logs for unexpected logins to privileged accounts such as crushadmin. Given confirmed ransomware use, treat internet-exposed instances as actively targeted and verify there are no signs of prior compromise after patching. | 9.8 | 100% | KEV ransomware PoC ×4 |
| moderate≈5,000–10,000 internet-exposed CrushFTP servers (public scan counts), with additional uncounted internal enterprise deployments |
Full article510 words · extracted from helpnetsecurity.com · click to collapse
Exploitation attempts targeting the CVE-2025-2825 vulnerability on internet-facing CrushFTP instances are happening, the Shadowserver Foundation has shared on Monday, and the attackers have been leveraging publicly available PoC exploit code.
What can be done?
CVE-2025-2825, affecting CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0, is an authentication bypass vulnerability that may allow unauthenticated attackers to access CrushFTP servers through an exposed HTTP(S) port.
The vulnerability was privately disclosed to CrushFTP customers via email on March 21. The missive did not include a CVE number for the flaw, and said that it only affected version 11 of the solution.
Subsequently, CrushFTP confirmed in a security advisory that the vulnerability also affected v10, and that it cannot be exploited if the DMZ proxy instance of CrushFTP is in place.
Other than confirming that the vulnerability was responsibly disclosed and they had no indication that it was being actively exploited, the company has declined to share more details.
Since then, several security companies have released a technical analysis of the vulnerability and a proof-of-concept exploit (PoC) for it, which the attackers have now started using.
According to Shadowserver, there are still around 1,500 internet-facing, unpatched instances vulnerable to CVE-2025-2825 out there.
To plug the hole, they should be updated to v10.8.4 or v11.3.1. Those who haven’t done it by now should check if their installation has been accessed by attackers. Rapid7 has shared possible indicators of compromise.
CVE confusion
As it happens, the CrushFTP’s security advisories for version 11 and 10 didn’t list the flaw’s CVE number until today, and the changelog for CrushFTP v11.3.1 – which includes the fix – still doesn’t.
But the company’s CEO has taken umbrage at vulnerability intelligence firm VulnCheck – which is a CVE Numbering Authority – for having assigned a CVE for it.
“The real CVE is pending,” the CrushFTP CEO told Jacob Baines, VulnCheck’s CTO, last week.
This Monday, the company revealed to SecurityWeek that the actual CVE for the vulnerability is CVE-2025-31161 and was discovered and disclosed by researchers with Outpost24.
CVE numbers are essential for tracking vulnerabilities because they provide a standardized way to identify and talk about specific security flaws across different tools, platforms, and teams, so VulnCheck’s action is understandable.
The public entry for CVE-2025-2825 will now likely be deleted, and CVE-2025-31161 will likely be used as the reference for this bug going forward. However, this unnecessary confusion could have been easily avoided if CrushFTP had mentioned from the start that they were waiting for a CVE number to be assigned.
UPDATE (April 7, 2025, 05:30 a.m. ET):
Huntress researchers have observed in-the-wild exploitation of CVE-2025-31161 on four hosts from four different companies, and have revealed that the attackers are leveraging the access obtained through it to:
- Install a malicious AnyDesk RMM instance, dump the SAM and System registry hives to harvest credentials
- Deploy MeshAgent – agent software for the legitimate open source remote monitoring platform MeshCentral – for remote access functionalities (sending commands, maintaining persistence, etc.)
- Deploy a Telegram bot (likelty to collect telemetry from infected hosts).
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2025/04/01/crushftp-vulnerability-exploitation-cve-2025-2825/