Customers of the CrushFTP enterprise file switch software program are being urged to replace to the most recent model following the invention of a security flaw that has come below focused exploitation within the wild.
“CrushFTP v11 variations under 11.1 have a vulnerability the place customers can escape their VFS and obtain system information,” CrushFTP mentioned in an advisory launched Friday. “This has been patched in v11.1.0.”
That mentioned, clients who’re working their CrushFTP cases inside a DMZ (demilitarized zone) restricted atmosphere are protected in opposition to the assaults.
Simon Garrelou of Airbus CERT has been credited with discovering and reporting the flaw. It has but to be assigned a CVE identifier.
Cybersecurity firm CrowdStrike, in a publish shared on Reddit, mentioned it has noticed an exploit for the flaw getting used within the wild in a “focused trend.”
These intrusions are mentioned to have primarily focused U.S. entities, with the intelligence gathering exercise suspected to be politically motivated.
“CrushFTP customers ought to proceed to comply with the seller’s web site for probably the most up-to-date directions and prioritize patching,” CrowdStrike mentioned.
