Summary:

CISA has added CVE-2025-31161 to their known exploited vulnerability (KEV) database. CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.

This addition comes on the heels of a controversial disclosure of the vulnerability by two different entities.

Security Officer Comments:

We have been warning about this vulnerability since last week. Ransomware groups like CL0P have historically targeted similar vulnerabilities in the past to steal sensitive data from victims. The dangers of this vulnerability were compounded when Outpost24 responsibly disclosed the vulnerability as CVE-2025-31161, and VulnCheck independently posted their own CVE-2025-2825, which included a working proof-of-concept. This conflicting disclosure created confusion for users, and will likely accelerate exploitation.

VulnCheck’s uncoordinated disclosure enabled threat actors to weaponize the flaw weeks before the embargo ended, leading to widespread attacks. Shadowserver observed exploitation within 48 hours of the PoC release.

Timeline of Events: