VDB
BDU%3A2025-03886
BDU%3A2025-03886
PUBLISHED
CVSS 10 CRITICAL
Уязвимость реализации алгоритма AWS4-HMAC-SHA256 кроссплатформенного FTP-сервера CrushFTP, позволяющая нарушителю обойти ограничения безопасности, получить доступ к учетной записи администратора и выполнить произвольные команды
Risk Scores
CVSS 2.0
10
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Converge Technology Solutions | CrushFTP |
Timeline
- Apr 10, 2025 CVE Published
- Aug 13, 2025 CVE Updated
References
- https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis url
- https://crushftp.com/crush11wiki/Wiki.jsp?page=Update#section-Update-VulnerabilityInfo url
- https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/ url
- https://projectdiscovery.io/blog/crushftp-authentication-bypass url
- https://www.darkreading.com/vulnerabilities-threats/disclosure-drama-clouds-crushftp-vulnerability-exploitation url
- https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation url
- https://www.infosecurity-magazine.com/news/crushftp-flaw-exploited-disclosure/ url
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update advisory