CrushFTP CEO's feisty response to VulnCheck's CVE for critical make-me-admin bug

CrushFTP's CEO is not happy with VulnCheck after the CVE numbering authority (CNA) released an unofficial ID for the critical vulnerability in its file transfer tech disclosed almost a week ago. According to an email exchange between CrushFTP's Ben Spink and VulnCheck's CTO Jacob Baines, shared by the latter as a screenshot on X on Wednesday, Spink responded to the CNA aggressively after Baines sent an email about the issuance of CVE-2025-2825 (9.8). Spink's response email purportedly read: "You don't know any details on this issue. Yours [CVE] will be deleted as a duplicate. You did not discover this. The real CVE is pending. Your reputation will go down if you do not voluntarily remove your fake item. It will be blatantly obvious when the real CVE is live since it literally explains in detail the vulnerability you know nothing about. "Please note! Due to a recent vulnerability, make certain you are using either CrushFTP v10.8.4+ or v11.3.1. Anything earlier is unsafe!" For context, CrushFTP told customers via email on March 21 about a critical vulnerability, prompting them to "take immediate action to patch ASAP." It also promised to generate a CVE "soon." It is now six days later and a CVE from CrushFTP itself has not yet materialized. Assigning CVEs for vulnerabilities in a timely manner is important for defenders so they can easily track and prioritize the issues affecting their IT estate. Withholding them can lead to confusion and delays for customers. CrushFTP's own ad...