# CVE-2025-31161: CrushFTP - Authentication Bypass

> Live exploitation tracking for CVE-2025-31161 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-31161

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** CrushFTP
- **Weaknesses:** CWE-305 (Authentication Bypass by Primary Weakness)
- **Tags:** file_sharing

## Description

CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability that allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement.

## CrowdSec analysis

[CVE-2025-31161](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-31161) is a critical vulnerability affecting CrushFTP that enables authentication bypass, potentially allowing attackers to take over administrative accounts without valid credentials.

CrowdSec has been tracking this vulnerability and its exploits since 7th of April 2025.

CrowdSec network observations suggest that most exploitation of CVE-2025-31161 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
In addition, according to the CrowdSec network, attack volume against CVE-2025-31161 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Exploit attempts are specifically directed towards URLs containing `/webinterface/function/` along with certain user-related parameters.

## Timeline

- 2025-03-26: CVE Published. CVE-2025-31161 is published to NVD.
- 2025-04-07: Rule Released. CrowdSec releases a rule to detect CVE-2025-31161 exploitation attempts against the CrowdSec Network.
- 2025-04-07: CISA KEV. CVE-2025-31161 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2025-04-25: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-31161 for the first time.
- 2025-04-28: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://www.rapid7.com/blog/post/2025/03/25/etr-notable-vulnerabilities-in-next-js-cve-2025-29927/
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31161.yaml
- https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation
- https://www.infosecurity-magazine.com/news/crushftp-flaw-exploited-disclosure/
- https://www.vicarius.io/vsociety/posts/cve-2025-31161-mitigate-crushftp-vulnerability
- https://projectdiscovery.io/blog/crushftp-authentication-bypass
- https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/
- https://www.vicarius.io/vsociety/posts/cve-2025-31161-detect-crushftp-vulnerability
- https://crushftp.com/crush11wiki/Wiki.jsp?page=Update#section-Update-VulnerabilityInfo

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-31161) follows observed exploitation activity for CVE-2025-31161. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.