Description
DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2025-31161. Reason: This Record is a reservation duplicate of CVE-2025-31161. Notes: All CVE users should reference CVE-2025-31161 instead of this Record. All references and descriptions in this Record have been removed to prevent accidental usage.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
CrushFTP AWS4-HMAC Authentication Bypass
auxiliary/gather/crushftp_authbypass_cve_2025_2825
GitHub 4 repositories
-
ghostsec420/ShatteredFTP ★ 13 · Apr 11, 2025
Shattered is a tool and POC for the new CrushedFTP vulns, CVE Exploit Script: CVE-2025-2825 vs CVE-2025-31161
-
Shivshantp/CVE-2025-2825-CrushFTP-AuthBypass ★ 5 · Jul 22, 2025
Authentication Bypass PoC for CVE-2025-2825 – Exploiting CrushFTP 10.x
-
iteride/CVE-2025-2825 ★ 1 · Sep 23, 2025
-
WOOOOONG/CVE-2025-2825 ★ 1 · Apr 3, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- WID-SEC-2025-0615 CrushFTP: Schwachstelle ermöglicht das Umgehen der Authentisierung BSI CERT-Bund (WID) · Apr 2, 2025