CrushFTP
Security incidents tagged CrushFTP. Newest first.
0 CrushFTP incidents in the last 12 months
- Incidents
- 3
- Live
- 0
- Patched
- 3
- Days without an incident
- 457
- Longest quiet run: 458 days (Jul 23–Oct 23)
Show 3 older incidents3 older incidents
July 2025 1
PatchedCrushFTP: CrushFTP Unprotected Alternate Channel Vulnerability
CrushFTP
CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS. Added to CISA KEV on 2025-07-22.
Open incident →CVE-2025-54309
April 2025 1
PatchedCrushFTP: Authentication Bypass Vulnerability
CrushFTP
CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise. Added to CISA KEV on 2025-04-07.
Open incident →CVE-2025-31161
April 2024 1
PatchedCrushFTP VFS Sandbox Escape
CrushFTP
CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS). Added to the CISA KEV catalog on 2024-04-24.
Open incident →CVE-2024-4040
