Summary
CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.
- Vendor
- CrushFTP
- Product
- CrushFTP
- Added to KEV
- Apr 7, 2025
- Remediation due
- Apr 28, 2025 (US federal deadline)
- Ransomware use
- Known
- Weakness
- CWE-305
- EPSS
- 100.0% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References