Article
Remote support and file transfer flaws in ransomware attacks
SimpleHelp, CrushFTP, GoAnywhere and BeyondTrust flaws were flagged by CISA for ransomware use in 2025 and 2026. Dates, fixes, attribution and checks.
Read more
Exploited vulnerability
CrushFTP authentication bypass (CVE-2025-31161)
CVE-2025-31161
CVE-2025-31161 is a flaw in CrushFTP, a file transfer server, that lets an outsider sign in as another user without a password.
- On CISA KEV
- CVE ID
- CVE-2025-31161
- CISA KEV
- Listed
- Affected product
- CrushFTP
- Exploited
- Yes
- Published
- April 2025
In short
CVE-2025-31161 is a flaw in CrushFTP, a file transfer server, that lets an outsider sign in as another user without a password. The target can be any known or guessable account, such as the built-in administrator account crushadmin. CISA lists it as exploited and flags known ransomware campaign use.
- CVECVE-2025-31161
- ProductCrushFTP CrushFTP
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps4actions listedUpdate CrushFTP · Use a DMZ proxy instance
What it allows
A remote attacker with no account can authenticate as any known or guessable user and, by taking the administrator account, can fully compromise the system. NVD scores it 9.8 out of 10 (CVSS v3.1). NVD explains that a race condition in the AWS4-HMAC (S3 compatible) sign-in method, plus a malformed header with only a username and a slash, makes the bypass dependable.
Who is affected
NVD: CrushFTP 10 before 10.8.4 and CrushFTP 11 before 11.3.1. The vendor's update page, which also covers other flaws, says 11.0.0 to 11.3.4 and 10.0.0 to 10.8.4 are vulnerable and tells customers to update to 11.3.4_23 or later, or 10.8.5 or later. The vendor says the exploit does not work if a DMZ proxy instance of CrushFTP is in place.
CrushFTP published fixed builds 10.8.4 and 11.3.1 on 21 March 2025. The Canadian Cyber Centre alert of 2 April 2025 says a proof of concept was available and that it was aware of reports of exploitation. NVD published the record on 3 April 2025 and says the flaw was exploited in the wild in March and April 2025.
CISA added CVE-2025-31161 to its Known Exploited Vulnerabilities (KEV) catalog on 7 April 2025, with a due date of 28 April 2025 for US federal agencies. The KEV entry flags known use in ransomware campaigns.
The official sources opened here do not name any actor behind the exploitation, so this page lists none.
What to do
-
Update CrushFTP
The vendor says to update to 11.3.4_23 or later on version 11, or 10.8.5 or later on version 10. The Canadian Cyber Centre named 10.8.4 or later and 11.3.1 or later as the minimum. Turn on automatic updates if you can.
-
Use a DMZ proxy instance
The vendor says the exploit does not work when the DMZ proxy instance of CrushFTP is in place. Treat this as an extra layer, not a replacement for updating.
-
Reduce internet exposure
Limit the web interface to the addresses that need it, as an internet facing transfer server is easy for attackers to find. The vendor says staying up to date is critical for such a server.
-
Detect and hunt
The Canadian Cyber Centre advises monitoring affected systems for exploitation. Check for unexpected sign-ins to crushadmin or other known accounts, new admin users and unexpected file downloads from March 2025 onward. Review web logs for requests that use the AWS4-HMAC sign-in method with only a username.
Questions
What is CVE-2025-31161?
It is an authentication bypass in CrushFTP, a file transfer server. An outsider can sign in as any known or guessable user without a password, such as the built-in administrator account crushadmin, and by taking that account can fully compromise the system.
Which CrushFTP versions are vulnerable to CVE-2025-31161?
NVD lists CrushFTP 10 before 10.8.4 and CrushFTP 11 before 11.3.1. The vendor update page says 11.0.0 to 11.3.4 and 10.0.0 to 10.8.4 are vulnerable and advises updating to 11.3.4_23 or later, or 10.8.5 or later.
Does a DMZ proxy protect against CVE-2025-31161?
The vendor says the exploit does not work if a DMZ proxy instance of CrushFTP is in place. Treat it as an extra layer, not a replacement for updating. Also limit the web interface to the addresses that need it.
In our research
Sources
- CVE-2025-31161 record NIST NVD
- CrushFTP Update and vulnerability info CrushFTP
- AL25-003 Vulnerability impacting CrushFTP Canadian Centre for Cyber Security
- CISA Adds One Known Exploited Vulnerability to Catalog (7 April 2025) CISA
- Known Exploited Vulnerabilities catalog CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.