CrushFTP product

Several products

← All CrushFTP products

No CISA KEV deadline is open. CISA last added a Several products CVE on 22 Jul 2025.

Tracked since 3 Mar · latest article Tue 7 Apr · RSS

Open KEV deadlines: 0; None open
Added to KEV · 90 days: 0; of 3 all time
High exploit odds · current: 0; high · not in KEV
Articles · 7 days: 0; usual rate

Exploited, by due date

CSV download

CVEProductAddedDue · federal deadline

Deadlines passed

CVE-2025-54309CrushFTP22 Jul 2025Deadline passed 12 Aug 2025Ransomware: Unknown · 1 article

CVE-2025-31161CrushFTP7 Apr 2025Deadline passed 28 Apr 2025Ransomware: Known · 2 articles

CVE-2024-4040CrushFTP24 Apr 2024Deadline passed 1 May 2024Ransomware: Unknown · 1 article

Coverage

2 articles · all timeFull timeline →

Two articles so far, 3 Mar to 7 Apr.

1 2

Tue 3 Mar · first reportCrushFTP Brute Force Attacks Target Admin Logins from French IPSANS ISC
Tue 7 AprStorm-1175 Deploys Medusa Ransomware at 'High Velocity'Dark Reading

See the full timeline

7 AprStorm-1175 Deploys Medusa Ransomware at 'High Velocity'Dark Reading
3 MarCrushFTP Brute Force Attacks Target Admin Logins from French IPSANS ISC

All CVEs in coverage

CVE-2025-31161CrushFTP Authentication Bypass VulnerabilityCVSS9.8CriticalExploited99.9%EPSS2articles

CVE-2024-4040CrushFTP VFS Sandbox Escape VulnerabilityCVSS9.8CriticalExploited99.5%EPSS1article

CVE-2025-54309CrushFTP Unprotected Alternate Channel VulnerabilityCVSS9.0CriticalExploited93%EPSS1article

How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

Several products

Exploited, by due date

Coverage

All CVEs in coverage

On this device

Intel

Settings

Keyboard shortcuts