CrushFTPExploited incident
CrushFTP unauthenticated HTTP(S) authentication bypass (March 2025)
CVE-2025-31161Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 7 Apr 2025
- Exploited after a fix existed
- Known ransomware use
Response
- Silence
- same day First public report to first vendor statement
- Exposure
- same day First public report to first fix
- Follow-through
- same day First public report to a fix for every supported version
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Fixed when disclosed
- Date only, no time of day
Timeline and evidence
Open a moment to see its source and archived quote.
First public report
date only
CrushFTP wiki: Update page (Wayback snapshot 2025-03-27, revision 58 of 21-Mar-2025)CuratedQuote verified
March 21, 2025 - Unauthenticated HTTP(S) port access on CrushFTPv10/v11 (CVE:TBA)
Coordinated disclosure: CrushFTP's notice (page revision-58, 'last changed on 21-Mar-2025 07:08 by Ben Spink') shipped with fixes and said the bug was not known to be exploited. Exploitation followed after public technical details (see the Huntress candidate).
- Source
- CrushFTP wiki: Update page (Wayback snapshot 2025-03-27, revision 58 of 21-Mar-2025) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:c2dbcc57c0c9f4c6…- Used in metrics
- Yes
6 more sources for this moment
CrushFTP advisory CVE-2025-31161ClaimedQuote verified21 Mar 2025
March 21, 2025 - Unauthenticated HTTP(S) port access on CrushFTPv10/v11 (CVE: CVE-2025-31161) This issue affects both CrushFTP v10 and v11. The exploit does not work if you have the DMZ proxy instance of CrushFTP in place. The vulnerability was respnsibly
The vendor's own disclosure.
- Source
- CrushFTP advisory CVE-2025-31161 vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:55f359d079e35228…- Used in metrics
- No, kept for the record
Bluesky postClaimedQuote not checked yet1 Apr 2025, 11:17 UTC
Shadowserver has started seeing exploitation attempts aimed at a CrushFTP vulnerability tracked as CVE-2025-2825 and CVE-2025-31161.
Earliest third-party post we hold.
- Source
- Bluesky post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
CVE.org record CVE-2025-31161ClaimedQuote verified3 Apr 2025, 00:00 UTC
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April
CVE record published.
- Source
- CVE.org record CVE-2025-31161 cve record
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:b88b6188d2ee88d3…- Used in metrics
- No, kept for the record
Huntress blog: CrushFTP CVE-2025-31161 Auth Bypass and Post-Exploitation (Published: April 4, 2025)CuratedQuote verified4 Apr 2025
On 3 April 2025, Huntress observed in-the-wild exploitation of CVE-2025-31161, an authentication bypass vulnerability in versions of the CrushFTP software.
Post published April 4, 2025; Huntress also found possible testing activity as early as 30 March 2025, after the 21 March fix.
- Source
- Huntress blog: CrushFTP CVE-2025-31161 Auth Bypass and Post-Exploitation (Published: April 4, 2025) research
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:b598b8d910d30828…- Used in metrics
- No, kept for the record
Mastodon postClaimedQuote not checked yet4 Apr 2025, 09:43 UTC
CVE Alert: CVE-2025-31161 - https://www. redpacketsecurity.com/cve_aler t_cve-2025-31161/ # OSINT # ThreatIntel # CyberSecurity # cve_2025_31161
Earliest third-party post we hold.
- Source
- Mastodon post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
CISA KEV (CVE-2025-31161)ClaimedQuote verified7 Apr 2025
CrushFTP Authentication Bypass Vulnerability
Added to CISA's KEV catalog on 2025-04-07.
- Source
- CISA KEV (CVE-2025-31161) kev
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:ef8fffede5c47200…- Used in metrics
- No, kept for the record
Vendor statement
date onlysame day
CrushFTP advisory CVE-2025-31161ClaimedQuote verified
March 21, 2025 - Unauthenticated HTTP(S) port access on CrushFTPv10/v11 (CVE: CVE-2025-31161) This issue affects both CrushFTP v10 and v11. The exploit does not work if you have the DMZ proxy instance of CrushFTP in place. The vulnerability was respnsibly
- Source
- CrushFTP advisory CVE-2025-31161 vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:55f359d079e35228…- Used in metrics
- Yes
1 more source for this moment
CrushFTP wiki: Update page (Wayback snapshot 2025-03-27)CuratedQuote verified21 Mar 2025
This page (revision-58) was last changed on 21-Mar-2025 07:08 by Ben Spink
- Source
- CrushFTP wiki: Update page (Wayback snapshot 2025-03-27) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:c2dbcc57c0c9f4c6…- Used in metrics
- No, kept for the record
First workaround
No official mitigation found yet.
First fix
date onlysame day
CrushFTP wiki: Update page (current)CuratedQuote verified
10.8.4 and 11.3.1 were published on 3/21/2025
- Source
- CrushFTP wiki: Update page (current) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:55f359d079e35228…- Used in metrics
- Yes
Fixed for all versions
date onlysame day
CrushFTP wiki: Update page (current)CuratedQuote verified
10.8.4 and 11.3.1 were published on 3/21/2025
Fixes for both supported major versions (v10 and v11) were published the same day.
- Source
- CrushFTP wiki: Update page (current) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:55f359d079e35228…- Used in metrics
- Yes
Send this to your boss
No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.
Affected products
- CrushFTP 10.0.0 through 10.8.3
- CrushFTP 11.0.0 through 11.3.0
How we built this timeline
Coordinated disclosure that became messy: CrushFTP fixed the bug on 21 Mar 2025 with no CVE ('CVE:TBA'); a separate CVE (CVE-2025-2825) was issued by a third party in late March, and the reporter's CVE-2025-31161 was published on 3 Apr 2025 (NVD: 2025-04-03T20:15 UTC). The current Update page calls the other CVE 'a copycat CVE' (it misprints the ID as 'CVE-2025-0282'). exploited before a fix=false: CrushFTP said on 21 Mar 2025 it was not known to be exploited, and the first exploitation evidence Huntress reports is from 30 Mar 2025 onward.
KEV lists known ransomware use. Severity/CVSS from the CNA/NVD score 9.8.
Related
No related incidents.