CISA Warns of CrushFTP Vulnerability Exploitation in the Wild
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-2825 | A vulnerability classified as critical has been found in lakernote EasyAdmin up to 20240315 | 8.8 | <1% | PoC | |
| CVE-2025-2825 | Rejected reason: DO NOT USE THIS CVE RECORD | — | — | ||
| CVE-2025-31161 | Authentication Bypass in CrushFTP File Transfer Servers (CVE-2025-31161) | 9.8 | 100% | KEVRansomwarePoC ×5 | KEV |
From the original article
2 min read at infosecurity-magazine.com
The US top cybersecurity agency has confirmed that the critical vulnerability in file transfer solution provider CrushFTP ’s product is being exploited in the wild. The authentication bypass vulnerability, CVE-2025-31161, was added to the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog on April 7.
By Kevin Poireault · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.