Critical CrushFTP Authentication Bypass Vulnerability Now Under Active Exploitation

A single reused flag turned password checking off.

CVE-2025-2825 carries a CVSS score of 9.8 and affects CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0, because a parameter-overloading error let a password-lookup flag be reused as an authentication-bypass control.

The technical root cause is precise: a flag meant for password lookup (lookup_user_pass) was reused as an authentication-bypass control (anyPass). That lets an attacker skip password validation entirely by crafting an HTTP request with an AWS S3-style authorization header containing a valid username and a specially formatted CrushAuth cookie. No credentials, no problem, from the attacker's point of view. The flaw was responsibly disclosed by researchers at Outpost24.

Public proof-of-concept code turned disclosure into attacks within days.

Once proof-of-concept exploit code was published, attackers moved fast: the Shadowserver Foundation detected dozens of exploitation attempts against internet-exposed CrushFTP servers, with over 1,500 vulnerable instances still online as of March 30, 2025.

ProjectDiscovery released technical details and a working exploit, and Shadowserver's honeypots kept detecting attempts even as the count of exposed instances dropped by a few hundred the next day. This is the usual pattern for internet-facing file-transfer software: the window between public exploit and mass scanning is measured in hours, not weeks.

• The naming confusion. VulnCheck assigned CVE-2025-2825, while CrushFTP indicated Outpost24 assigned CVE-2025-31161. The industry largely tracks it as CVE-2025-2825, but you may see both identifiers for the same flaw.
• This is not CrushFTP's first. In April 2024, CrushFTP patched an actively exploited zero-day (CVE-2024-4040) that let attackers escape the virtual file system and download system files; CrowdStrike assessed that campaign as likely politically motivated intelligence gathering.
• Vendor friction. CrushFTP publicly criticized the security firms that released technical details, calling them bad actors for accelerating weaponization, a reminder that disclosure timing is contentious, but the patch is what protects you either way.

One patch closes it. A few habits keep the next one from mattering as much.

CrushFTP fixed the flaw in version 11.3.1 by disabling the vulnerable S3 password-lookup path by default and adding proper authentication checks, so the primary fix is to upgrade to 11.3.1 or later immediately.

• Patch to 11.3.1 or later. The dashboard update takes about five minutes, and offline update methods exist for systems without direct internet access. This is the fix; do it first.
• If you cannot patch yet, enable the DMZ option. CrushFTP's DMZ perimeter-network setting shields the server as a temporary workaround until you can update.
• Get file-transfer servers off the open internet. Put management interfaces behind a VPN or allowlist, so a future flaw is not directly reachable by every scanner on the internet.
• Watch for known-exploited CVEs. Track advisories for the software you expose, and prioritize anything already being exploited in the wild for same-day patching.
• Assume file-transfer tools are targets. Ransomware groups hunt managed file-transfer products specifically. Monitor their logs and lock down access accordingly.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

• Through cybersecurity services, we run continuous vulnerability management and rapid patching for critical flaws like the CrushFTP bypass.
• With regular security assessments, we find the exposed and vulnerable services on your network before attackers do.
• With managed IT support and 24/7 monitoring, we detect and respond to exploitation attempts in real time.
• Backed by Houston IT support, we apply secure configuration, segmentation, and incident-response planning to shrink your attack surface.

A single unpatched, internet-facing service is all an attacker needs. If you run CrushFTP or any managed file-transfer software, confirm it is patched and not directly exposed. Talk to CinchOps about securing your file-transfer infrastructure.