A critical authentication bypass vulnerability in CrushFTP, identified as CVE-2025-31161, has been actively exploited by remote attackers following a mishandled disclosure process.
The flaw, which allows unauthenticated access to devices running unpatched versions of CrushFTP v10 or v11, has a CVSSv3.1 severity score of 9.8.
Security analysts at Outpost24 said they originally discovered the vulnerability and sought to follow a responsible disclosure timeline, working with MITRE to secure a CVE on March 13, 2025.
They coordinated with CrushFTP under an agreed 90-day non-disclosure period to ensure users had sufficient time to patch before details became public.
However, the disclosure process was disrupted when another company, VulnCheck, published a separate CVE – CVE-2025-2825 – allegedly without consulting Outpost24 or CrushFTP. This led to the vulnerability becoming widely known before users could update their systems, resulting in active exploitation.
Over 1500 vulnerable instances have been identified online by the Shadowserver Foundation.
No tags.
