VulnerabilityPublished 3 Mar 2026

Bruteforce Scans for CrushFTP , (Tue, Mar 3rd)

Source SANS ISC Handlers Diary

Mentioned vulnerabilities

Severity

High

Rated High by Threat Radar from the SANS ISC Handlers Diary text

Data as of 9 Mar 2026, 17:30 UTC

What to do

AI-suggested

Immediately audit all CrushFTP instances to identify weak or default admin credentials, especially the use of 'crushadmin' as username and password.
Enforce strong, unique passwords for all administrative accounts; avoid suggested default usernames and passwords.
Implement account lockout policies or rate limiting to mitigate brute-force attempts.
Enable multi-factor authentication (MFA) if supported by CrushFTP or via external access controls.
Monitor server logs for repeated failed login attempts and block suspicious IP addresses, including the identified malicious IP 5.189.139.225.
Restrict access to the CrushFTP administrative interface to trusted IP ranges or via VPN.
Keep CrushFTP software updated with the latest patches and security fixes.
Conduct regular security assessments and penetration testing focused on authentication mechanisms.
Educate administrators on secure configuration practices and the risks of default credentials.
Consider deploying web application firewalls (WAFs) or intrusion prevention systems (IPS) to detect and block brute-force patterns.

Description

CrushFTP is a Java-based open source file transfer system. It is offered for multiple operating systems. If you run a CrushFTP instance, you may remember that the software has had some serious vulnerabilities: CVE-2024-4040 (the template-injection flaw that let unauthenticated attackers escape the VFS sandbox and achieve RCE), CVE-2025-31161 (the auth-bypass that handed over the crushadmin account on a silver platter), and the July 2025 zero-day CVE-2025-54309 that was actively exploited in the wild.

Impact

If attackers successfully brute-force the admin credentials on a CrushFTP server, they can gain full administrative access, allowing them to upload, download, modify, or delete files, potentially leading to data breaches, data loss, or service disruption. Administrative control could also enable attackers to pivot within the network, deploy malware, or establish persistent access. Organizations relying on CrushFTP for sensitive file transfers may face confidentiality and integrity breaches. The impact is amplified if the server hosts critical or regulated data. Additionally, compromised servers could be used as a launchpad for further attacks or to distribute malicious files. While no active exploitation of new vulnerabilities is reported, the ease of brute-force attacks on weak credentials poses a significant risk, especially for organizations that have not enforced strong password policies or multi-factor authentication. The threat affects availability indirectly if attackers disrupt services or delete files. Overall, the impact ranges from moderate to high depending on the sensitivity of data and the network environment.

Summary

CrushFTP is a cross-platform, Java-based file transfer server software that has historically been affected by critical vulnerabilities, including CVE-2024-4040 (template injection allowing unauthenticated remote code execution), CVE-2025-31161 (authentication bypass granting admin access), and a zero-day CVE-2025-54309 exploited in the wild in mid-2025. Despite these past issues, the current threat landscape involves brute-force scanning rather than exploitation of a new vulnerability. Attackers are targeting CrushFTP instances by attempting to log in using the commonly suggested default admin username 'crushadmin' with the same password 'crushadmin'. The login attempts are conducted via POST requests where credentials are passed as GET parameters, which is unusual but accepted by the server. These brute-force scans originate from a French IP address (5.189.139.225) with a history of probing for simple vulnerabilities. The attack leverages weak or default credentials set by administrators who may have neglected to change suggested usernames and passwords during setup. Successful brute-force login could allow attackers to gain administrative control over the CrushFTP server, potentially leading to unauthorized file access, data exfiltration, or further system compromise. No new CVEs or zero-day exploits are involved in this activity, and no known active exploitation of vulnerabilities is currently reported. The threat highlights the importance of secure configuration and credential management in CrushFTP deployments.

References

isc.sans.edu/diary/rss/32762 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 4 Mar 2026, 02:06 UTC

References

Community reviews

Related threats