CVE-2025-32102

MEDIUM EXPLOITED

CrushFTP 9.0.0-10.8.4 and 11.0.0-11.3.1 - Server-Side Request Forgery via TelnetSocket Command

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2025-32102 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI.

References (4)

Core 4
Core References
Exploit, Third Party Advisory, VDB Entry
https://packetstorm.news/files/id/190460/
Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2025/Apr/17

Scores

CVSS v3 5.0
EPSS 0.0574
EPSS Percentile 92.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

VulnCheck KEV 2024-04-26
CWE
CWE-918
Status published
Products (1)
crushftp/crushftp 9.0.0 - 11.3.1
Published Apr 15, 2025
Tracked Since Feb 18, 2026