CrushFTP Auth Bypass CVE-2025-31161 Exploited in the Wild

What to do

1. Check the build in CrushFTP.log (Version entry) or the admin UI and upgrade to the current release
2. Do not stop at 10.8.4/11.3.1: CrushFTP now lists 10.8.5+ and 11.3.4_23+ as minimums after a July 2025 flaw (CVE-2025-54309)
3. Put the CrushFTP DMZ proxy instance in front of internet-facing servers
4. Audit the user list for unknown admin accounts and reset the crushadmin password
5. Allow the server to reach CrushFTP update servers so update notices arrive

How to check if you are affected or compromised

• Search CrushFTP logs for Authorization headers containing 'AWS4-HMAC-SHA256 Credential=crushadmin/' from unusual IPs
• Look for unexpected users (Huntress saw Eaion6Mz, CrushUser, vmadmin) and backdated last-login fields
• Alert on child processes of CrushFTPService.exe, e.g. AnyDesk, MeshAgent (mesch.exe), SimpleHelp, reg.exe exporting SAM/SYSTEM
• Review logs\session_logs for activity from 2025-03-30 onward

What happened#

On March 21, 2025, CrushFTP released 10.8.4 and 11.3.1 to fix what it called "Unauthenticated HTTP(S) port access." The CVE record explains the bug. In the S3-compatible AWS4-HMAC authorization path, the server first checks that a user exists by calling login_user_pass() without requiring a password. That opens a race window. Sending a mangled header with just a username and a slash makes the bypass reliable. The result is takeover of the crushadmin account (CVSS 3.1 9.8). The vendor's update page says the exploit does not work if the DMZ proxy instance is in place.

The disclosure turned into a public dispute. According to The Hacker News, Outpost24 found the bug, asked MITRE for a CVE on March 13 and agreed to a 90-day disclosure window with CrushFTP. Before MITRE assigned CVE-2025-31161 on March 27, VulnCheck, a separate CNA, published its own identifier, CVE-2025-2825. That ID is now rejected as a duplicate with the note "All CVE users should reference CVE-2025-31161." VulnCheck's Patrick Garrity said CrushFTP "deliberately requested that a CVE not be issued for 90-days." CrushFTP's own page calls the competing ID a "copycat CVE issued automatically by an unaffiliated company." The vendor page prints that ID as "CVE-2025-0282," which looks like a typo for 2825. Scanners and advisories from the first week often use CVE-2025-2825. It is the same bug.

Who is affected#

CrushFTP 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected. Exposure was significant: Shadowserver counted about 1,500 exposed vulnerable instances on March 30 and 815 unpatched on April 6 (487 in North America, 250 in Europe). Servers behind a CrushFTP DMZ proxy were not exploitable.

Do you really need to act?#

If you run CrushFTP, yes, though it is a check rather than an emergency in October 2026. A file-transfer server holds the data attackers want to steal, and this bug gave them full admin access with no password. Huntress saw possible testing on March 30 and confirmed exploitation on April 3. It eventually counted five hosts at five companies, three of them served by one MSP. An earlier count, cited by The Hacker News, was four. Attackers created a backdoor admin with a backdated last-login, installed AnyDesk, MeshAgent and later SimpleHelp, dumped SAM and SYSTEM hives, and staged a TgBot-based DLL. CISA added the CVE to KEV on April 7, 2025.

CrushFTP also had another exploited flaw in July 2025, CVE-2025-54309. The vendor page now lists 10.8.5+ and 11.3.4_23+ as minimums, so a server still on 11.3.1 is behind. The verdict is check-exposure: confirm you run a current build and audit accounts once.

What to do now#

1. Check the version. The Version line in CrushFTP.log (usually in C:\CrushFTP10 or C:\CrushFTP11) shows the full build.
2. Upgrade to the current CrushFTP release, not just 10.8.4 or 11.3.1.
3. Place the DMZ proxy instance in front of anything internet-facing.
4. Review all users. Delete unknown admins and reset the crushadmin password.
5. Let the server reach CrushFTP's update servers so update notices arrive. The vendor says instances notify admins within a day of a new release.

How to tell if you were hit#

Huntress's guidance is the most specific. Look for ACCEPT and POST log lines from unfamiliar IPs and for headers containing AWS4-HMAC-SHA256 Credential=crushadmin/. A legitimate session carries a currentAuth cookie. Check logs\session_logs. Hunt for child processes of CrushFTPService.exe, for files such as C:\Windows\Temp\mesch.exe and d3d11.dll, and for the accounts Eaion6Mz, CrushUser or vmadmin. If any are present, assume files on the server were stolen and that credentials stored on the host were taken.

Timeline#

• Mar 13, 2025 — Outpost24 requests a CVE from MITRE.
• Mar 21, 2025 — CrushFTP 10.8.4 and 11.3.1 released.
• Mar 26, 2025 — VulnCheck publishes CVE-2025-2825 (later rejected).
• Mar 27, 2025 — MITRE assigns CVE-2025-31161.
• Mar 30, 2025 — Possible first testing activity seen by Huntress.
• Apr 3, 2025 — Huntress confirms in-the-wild exploitation; CVE-2025-31161 published.
• Apr 7, 2025 — CISA adds CVE-2025-31161 to KEV.

Vulnerability records

• CVE-2025-31161 · KEV 2025-04-07 · CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. CVE Program — CVE-2025-31161 record (JSON) cveawg.mitre.org
2. CVE Program — CVE-2025-2825 record, rejected (JSON) cveawg.mitre.org
3. CrushFTP — Update wiki, Vulnerability Info crushftp.com
4. Huntress — CrushFTP CVE-2025-31161 auth bypass and post-exploitation huntress.com

Coverage and analysis

1. The Hacker News — CISA adds CrushFTP vulnerability to KEV thehackernews.com