The vulnerability of the implementation of the AWS4-HMAC-SHA256 algorithm in the cross-platform FTP server CrushFTP allows a hacker to bypass security restrictions, gain access to the administrator account, and execute arbitrary commands.

🗓️ 10 Apr 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 8 Views

CrushFTP flaw in AWS4-HMAC-SHA256 enables auth bypass via default crushadmin, granting admin access and arbitrary commands.

Reporter	Title	Published	Views	Family All 45
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	21 Oct 202517:49	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	20 Feb 202613:40	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	6 Jun 202509:14	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	8 Apr 202515:37	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	10 Sep 202500:20	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	21 Apr 202523:57	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	23 May 202521:04	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	29 Oct 202523:17	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	29 Jun 202620:41	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	29 Jun 202620:51	–	githubexploit

Vulners

Node

OR

converge_technology_solutions crushftpRange11.0.0–11.3.1

converge_technology_solutions crushftpRange10.0.0–10.8.4

Source	Link
attackerkb	www.attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis
crushftp	www.crushftp.com/crush11wiki/Wiki.jsp
outpost24	www.outpost24.com/blog/crushftp-auth-bypass-vulnerability/
projectdiscovery	www.projectdiscovery.io/blog/crushftp-authentication-bypass
darkreading	www.darkreading.com/vulnerabilities-threats/disclosure-drama-clouds-crushftp-vulnerability-exploitation
huntress	www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation
infosecurity-magazine	www.infosecurity-magazine.com/news/crushftp-flaw-exploited-disclosure/
web	www.web.nvd.nist.gov/view/vuln/detail

13 Aug 2025 00:00Current

8.3High risk

Vulners AI Score8.3

CVSS 39.8

CVSS 210

EPSS0.99947

crushftp vulnerability authentication bypass default crushadmin admin access arbitrary command execution cross platform ftp hash signature algorithm