Cyber Security

Critical Update: CrushFTP Zero-Day Flaw Exploited in Targeted Attacks

Apr 20, 2024NewsroomVulnerability / Endpoint Security

Users of the CrushFTP enterprise file transfer software are being urged to update to the latest version following the discovery of a security flaw that has come under targeted exploitation in the wild.

“CrushFTP v11 versions below 11.1 have a vulnerability where users can escape their VFS and download system files,” CrushFTP said in an advisory released Friday. “This has been patched in v11.1.0.”

That said, customers who are operating their CrushFTP instances within a DMZ (demilitarized zone) restricted environment are protected against the attacks.


Simon Garrelou of Airbus CERT has been credited with discovering and reporting the flaw. It has yet to be assigned a CVE identifier.

Cybersecurity company CrowdStrike, in a post shared on Reddit, said it has observed an exploit for the flaw being used in the wild in a “targeted fashion.”

CrushFTP Zero-Day Flaw

These intrusions are said to have mainly targeted U.S. entities, with the intelligence gathering activity suspected to be politically motivated.

“CrushFTP users should continue to follow the vendor’s website for the most up-to-date instructions and prioritize patching,” CrowdStrike said.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Articles You May Like

Infinix GT Book With Up to 13th Gen Intel Core i9 CPU, Nvidia GeForce RTX 4060 GPU Launched in India
Sonos Ace Wireless Headphones With ANC, Up to 30 Hours of Battery Life Launched: Price, Availability
Samsung Galaxy Ring India Price Tipped; Said to Come With a Monthly Subscription
Realme Buds Wireless 3 Neo With 13.4mm Drivers, ENC Support Launched in India: Price, Specifications
Paytm Signals Job Cuts, Asset Sales After Hit From India Probe