CrushFTP warns users to patch unauthenticated access flaw immediately

CrushFTP warned customers of an authentication bypass security vulnerability and urged them to patch their servers immediately. As the company also explained in an email sent to customers on Friday (seen by BleepingComputer), this critical-severity authentication bypass flaw (now tracked as CVE-2025-2825) enables attackers to gain access to unpatched servers if they are exposed on the Internet over HTTP(S). "Please take immediate action to patch ASAP. A vulnerability has been addressed today (March 21st, 2025). All CrushFTP v11 versions were affected. (No earlier versions are affected.)," the company warned. "The bottom line of this vulnerability is that an exposed HTTP(S) port could lead to unauthenticated access. The vulnerability is mitigated If you have the DMZ feature of CrushFTP in place." While the email says this vulnerability only affects CrushFTP v11 versions, an advisory issued on the same day says that both CrushFTP v10 and v11 are impacted, as cybersecurity company Rapid7 first noted. As a workaround, those who can't immediately update CrushFTP to versions 10.8.4+ or 11.3.1+ can enable the DMZ (demilitarized zone) perimeter network option to protect their CrushFTP instance until security updates can be deployed. According to Shodan, over 3,400 CrushFTP instances have their web interface exposed online to attacks, although BleepingComputer couldn't determine how many have already been patched. However, searching for all CrushFTP servers reachable over the Interne...