CrushFTP

Reported Context (4)

On 4 April 2025, the CrushFTP CVE-2025-31161 Auth Bypass and Post-Exploitation blog was published, and on 14 April 2025, the CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited in the Wild Huntress Finds Attackers Reused Tactics in CrushFTP and CentreStack Intrusions
CrushFTP CVE-2025-31161 Auth Bypass and Post-Exploitation Huntress Details CrushFTP CVE-2025-31161 Exploitation and Post-Exploitation Activity
On April 19, 2024, CrushFTP, a managed file transfer vendor disclosed a 0day vulnerability in several versions of its software through a private mailing list. CrushFTP CVE-2024-4040 Exploited in the Wild, Enables Unauthenticated Remote Code Execution
MFT vulnerability was identified by Converge Technology Solutions, originally in August 2023 impacting CrushFTP. Following responsible disclosure to the vendor, the vulnerability was publicly disclosed on November CrushFTP Vulnerability Could Expose Hosted Files and Enable Arbitrary Code Execution

CVE (4)

Malware (2)

People (1)

Threat Actors (1)

MITRE ATT&CK (10)

Vendors (3)

Products (8)

Tools (4)

Industries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.