CVE-2025-31161—CrushFTP Authentication Bypass Vulnerability

漏洞名称

CrushFTP Authentication Bypass Vulnerability

描述

CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.

已知用于勒索软件活动吗？

勒索软件状态：

KNOWN

采集行动

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

其他说明

• https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
• https://nvd.nist.gov/vuln/detail/CVE-2025-31161

相关新闻文章

• Hackers Exploit Critical CrushFTP Flaw to Gain Admin Access on Unpatched ServersJuly 20, 2025

相关 CWE

• CWE-305