Disclosure Drama Clouds CrushFTP Vulnerability Exploitation

A critical CrushFTP vulnerability now under exploitation in the wild has become mired in controversy and confusion. On March 31, the Shadowserver Foundation reported that exploitation activity was underway against CVE-2025-2825, a critical authentication bypass vulnerability in CrushFTP file transfer server software. Shadowserver's scans showed 1,512 vulnerable CrushFTP instances as of March 31, with exploitation attempts using a proof-of-concept (PoC) exploit that had been published days earlier. The vulnerability allows attackers to bypass authentication and gain access to the file transfer server through an exposed HTTP(S) port. The flaw received a CVSS score of 9.8 because it can be remotely executed and is easy to exploit, according to security researchers. Several vendors warned about CVE-2025-2825 prior to the exploitation activity. But as it turns out, CVE-2025-2825 was not the correct identifier for the CrushFTP vulnerability, which was disclosed earlier than planned by a third-party company. The early disclosure and ensuing confusion about the vulnerability led to attacks on CrushFTP customers, according to Outpost 24, which discovered the flaw. While vulnerability disclosure disputes are not common, they can lead to uncertainty around the severity and technical details of specific flaws. And in cases where duplicate CVEs are created for the same vulnerability, enterprise security teams may have a harder time tracking whether a flaw has been patched or not. Disputes...