{"cveID":"CVE-2025-31161","vendorProject":"CrushFTP","product":"CrushFTP","vulnerabilityName":"CrushFTP Authentication Bypass Vulnerability","dateAdded":"2025-04-07","shortDescription":"CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise. ","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","dueDate":"2025-04-28","knownRansomwareCampaignUse":"Known","notes":"https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update ; https://nvd.nist.gov/vuln/detail/CVE-2025-31161","cwes":["CWE-305"],"year":2025,"state":"mapped","stale_reasons":[],"mappings":[{"domain":"enterprise","cve":"CVE-2025-31161","technique":"T1078","technique_name_at_mapping":"Valid Accounts","mapping_type":"exploitation_technique","capability_group":"auth_bypass","comments":"This vulnerability in CrushFTP has been exploited to give attackers control how the software handles authentication, allowing access to the administrative account. From there, attackers have the ability to read and upload files, execute arbitrary code, create backdoors in the form of new administrative accounts, and conduct a full system takeover.","references":["https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2025-31161","technique":"T1059","technique_name_at_mapping":"Command and Scripting Interpreter","mapping_type":"primary_impact","capability_group":"auth_bypass","comments":"This vulnerability in CrushFTP has been exploited to give attackers control how the software handles authentication, allowing access to the administrative account. From there, attackers have the ability to read and upload files, execute arbitrary code, create backdoors in the form of new administrative accounts, and conduct a full system takeover.","references":["https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2025-31161","technique":"T1136","technique_name_at_mapping":"Create Account","mapping_type":"primary_impact","capability_group":"auth_bypass","comments":"This vulnerability in CrushFTP has been exploited to give attackers control how the software handles authentication, allowing access to the administrative account. From there, attackers have the ability to read and upload files, execute arbitrary code, create backdoors in the form of new administrative accounts, and conduct a full system takeover.","references":["https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"}],"techniques":[{"id":"T1059","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Command and Scripting Interpreter","name_at_mapping":"Command and Scripting Interpreter","renamed":false,"revoked_by":null,"mapping_types":["primary_impact"],"sigma_rule_count":95,"has_detection_strategy":true},{"id":"T1078","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Valid Accounts","name_at_mapping":"Valid Accounts","renamed":false,"revoked_by":null,"mapping_types":["exploitation_technique"],"sigma_rule_count":56,"has_detection_strategy":true},{"id":"T1136","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Create Account","name_at_mapping":"Create Account","renamed":false,"revoked_by":null,"mapping_types":["primary_impact"],"sigma_rule_count":3,"has_detection_strategy":true}],"mapping_types":["exploitation_technique","primary_impact"],"has_exploitation_technique":true,"mapping_attack_versions":["16.1"],"mapping_domains":["enterprise"],"sigma_coverage":"full","sigma_rules_tagged_cve":["459628e3-1b00-4e9b-9e5b-7da8961aea35"],"added_after_mapping_snapshot":false,"_source":"kevmap","_built":"2026-08-23 05:47 UTC","_attack_version":"19.2"}