Security readout for executives and security teams
Plain-English summary
CVE-2025-31161 lets an unauthenticated attacker bypass login on vulnerable CrushFTP servers and potentially take over the crushadmin account. The issue affects CrushFTP 10 before 10.8.4 and 11 before 11.3.1, with sources noting exploitation in March and April 2025.
Executive priority
Treat this as an urgent remediation item for any exposed CrushFTP deployment. It is critical severity, requires no credentials, affects administrative control, and is listed by CISA as known exploited.
Technical view
The flaw is in CrushFTP's HTTP component AWS4-HMAC S3-compatible authorization path. User existence is checked without requiring a password, and session cleanup can be avoided through the flawed authorization flow, allowing authentication as a known or guessable user such as crushadmin.
Likely exposure
Highest exposure is internet-accessible CrushFTP HTTP(S) service running version 10 before 10.8.4 or 11 before 11.3.1. The CVE text states DMZ proxy use changes exposure, but organizations should validate their exact deployment against vendor guidance.
Exploitation context
CISA KEV inclusion and the CVE description support active exploitation. Public sources describe in-the-wild exploitation during March and April 2025 and potential administrative takeover. The bundle does not prove every vulnerable instance was exploited.
Researcher notes
Evidence supports authentication bypass through the AWS4-HMAC authorization flow and possible account takeover. Avoid assuming exploitability solely from product presence; version, HTTP(S) exposure, and DMZ proxy architecture matter. Use vendor and CISA sources for final remediation deadlines and scope.
Mitigation direction
- Upgrade CrushFTP 10 to 10.8.4 or later.
- Upgrade CrushFTP 11 to 11.3.1 or later.
- Review CrushFTP vendor vulnerability guidance for deployment-specific mitigations.
- Restrict direct HTTP(S) exposure where vendor guidance supports that design.
- Assess DMZ proxy configuration rather than assuming protection.
Validation and detection
- Inventory all CrushFTP servers and record exact versions.
- Confirm whether HTTP(S) access is internet-facing or internally restricted.
- Verify any DMZ proxy deployment matches vendor guidance.
- Review admin accounts, especially crushadmin, for unauthorized changes.
- Check logs for suspicious authentication or administrative activity.
Public sources used
Michael Williams reviewed this cited source version on .
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-305: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-31161 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/CVE reference
- https://crushftp.com/crush11wiki/Wiki.jsp?page=Update#section-Update-VulnerabilityInfoCVE reference
- https://projectdiscovery.io/blog/crushftp-authentication-bypassCVE reference
- https://www.darkreading.com/vulnerabilities-threats/disclosure-drama-clouds-crushftp-vulnerability-exploitationCVE reference
- https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitationCVE reference
- https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysisCVE reference
- https://www.infosecurity-magazine.com/news/crushftp-flaw-exploited-disclosure/CVE reference
- https://www.vicarius.io/vsociety/posts/cve-2025-31161-detect-crushftp-vulnerabilityCVE reference
- https://www.vicarius.io/vsociety/posts/cve-2025-31161-mitigate-crushftp-vulnerabilityCVE reference
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31161CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authentication Bypass by Primary Weakness
Authentication Bypass by Primary Weakness represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.