Latest CrushFTP vulnerability (CVE-2025-2825) #
CrushFTP disclosed that a vulnerability in their file transfer product allows an unauthenticated remote attacker to bypass authentication on some HTTPS interfaces. Since the original disclosure, a CVE was assigned, CVE-2025-2825. There is no indication that this vulnerability is being exploited in the wild.
What is the impact? #
Successfully exploiting this vulnerability would allow an attacker to execute administrative functions within the CrushFTP service without authentication. Versions of CrushFTP 11 prior to 11.2.3 and CrushFTP 10 prior to 10.8.3 are vulnerable.
Are updates or workarounds available? #
CrushFTP has released versions 11.2.3 and 10.8.3 to address this issue. The vendor has also indicated that enabling the DMZ setting in the CrushFTP configuration will mitigate this issue. CrushFTP administrators are advised to update at their earliest opportunity.
How do I find potentially vulnerable systems with runZero? #
From the Software Inventory, use the following query to locate systems running potentially vulnerable software:
_asset.products:CrushFTP AND product:CrushFTPPrevious CrushFTP vulnerability (April 2024) #
CrushFTP disclosed that a vulnerability in their file transfer product allows an unauthenticated attacker to access the host's file system. No CVE has yet to be assigned for this issue and CrowdStrike has indicated that this issue is being actively exploited in the wild. Additional details can be found in this article by Sergiu Gatlan at BleepingComputer.
What is the impact? #
This issue affects all CrushFTP versions prior to 10.7.1 and CrushFTP 11 releases prior to patch 11.1.0. An unauthenticated attacker can abuse this issue to read files from the host's file system.
Are updates or workarounds available? #
CrushFTP has released versions 10.7.1 and 11.1.0 to address this issue.
How do I find potentially vulnerable systems with runZero? #
From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:
product:crushftp
