Critical Update: CrushFTP Zero-Day Flaw Exploited in Targeted Attacks

Cyber Security

Apr 20, 2024NewsroomVulnerability / Endpoint Security

Users of the CrushFTP enterprise file transfer software are being urged to update to the latest version following the discovery of a security flaw that has come under targeted exploitation in the wild.

“CrushFTP v11 versions below 11.1 have a vulnerability where users can escape their VFS and download system files,” CrushFTP said in an advisory released Friday. “This has been patched in v11.1.0.”

That said, customers who are operating their CrushFTP instances within a DMZ (demilitarized zone) restricted environment are protected against the attacks.


Simon Garrelou of Airbus CERT has been credited with discovering and reporting the flaw. It has yet to be assigned a CVE identifier.

Cybersecurity company CrowdStrike, in a post shared on Reddit, said it has observed an exploit for the flaw being used in the wild in a “targeted fashion.”

CrushFTP Zero-Day Flaw

These intrusions are said to have mainly targeted U.S. entities, with the intelligence gathering activity suspected to be politically motivated.

“CrushFTP users should continue to follow the vendor’s website for the most up-to-date instructions and prioritize patching,” CrowdStrike said.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Products You May Like

Articles You May Like

Microsoft Said to Plan Release of Next Call of Duty Game on Xbox Game Pass Subscription Service
$9 billion travel tech firm Navan on track to hit profitability this year and ‘not far’ from IPO, CEO says
North Korean Hackers Exploit Facebook Messenger in Targeted Malware Campaign
Foxit PDF Reader Flaw Exploited by Hackers to Deliver Diverse Malware Arsenal
Realme Buds Wireless 3 Neo With 13.4mm Drivers, ENC Support Launched in India: Price, Specifications

Leave a Reply

Your email address will not be published. Required fields are marked *