What is the severity of CVE-2025-2825?

CVE-2025-2825 is categorized as a critical vulnerability due to its potential for remote unauthenticated access.

How do I fix CVE-2025-2825?

To fix CVE-2025-2825, upgrade CrushFTP to versions 11.4.0 or later, or apply any available security patches.

Which versions of CrushFTP are affected by CVE-2025-2825?

CVE-2025-2825 affects CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0.

What type of attacks can occur due to CVE-2025-2825?

CVE-2025-2825 can allow attackers to perform unauthorized actions through unauthenticated HTTP requests.

Is authentication required to exploit CVE-2025-2825?

No, CVE-2025-2825 allows for exploitation without authentication, making it especially dangerous.

Vulnerability/
CVE-2025-2825

Exploited

critical

CWE

287

EPSS

17.541%

26/3/2025

4/4/2025

CVE-2025-2825: CrushFTP HTTP Unauthenticated Access

First published: Wed Mar 26 2025(Updated: )

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2025-31161. Reason: This Record is a reservation duplicate of CVE-2025-31161. Notes: All CVE users should reference CVE-2025-31161 instead of this Record. All references and descriptions in this Record have been removed to prevent accidental usage.

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
CrushFTP	>=10.0.0<=10.8.3>=11.0.0<=11.3.0

Never miss a vulnerability like this again

Reference Links

Peer vulnerabilities

(Found alongside the following vulnerabilities)

Frequently Asked Questions

What is the severity of CVE-2025-2825?
CVE-2025-2825 is categorized as a critical vulnerability due to its potential for remote unauthenticated access.
How do I fix CVE-2025-2825?
To fix CVE-2025-2825, upgrade CrushFTP to versions 11.4.0 or later, or apply any available security patches.
Which versions of CrushFTP are affected by CVE-2025-2825?
CVE-2025-2825 affects CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0.
What type of attacks can occur due to CVE-2025-2825?
CVE-2025-2825 can allow attackers to perform unauthorized actions through unauthenticated HTTP requests.
Is authentication required to exploit CVE-2025-2825?
No, CVE-2025-2825 allows for exploitation without authentication, making it especially dangerous.

agent/title
agent/first-publish-date
agent/type
agent/weakness
collector/the-register
source/The Register
alias/CVE-2025-2825
alias/CVE-2024-4040
collector/bleeping-computer
source/BleepingComputer
alias/CVE-2023-43177
agent/source
agent/news-ai
exploited/true
collector/epss-latest
source/FIRST
agent/epss
agent/trending
collector/nvd-api
source/NVD
agent/author
agent/last-modified-date
agent/guess-ai
agent/software-canonical-lookup
agent/softwarecombine
alias/CVE-2025-31161
collector/mitre-cve
source/MITRE
agent/references
agent/severity
agent/status
agent/description
agent/tags
agent/event
vendor/crushftp
canonical/crushftp
status/rejected

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.