CRITICAL AUTH BYPASS BUG IN CRUSHFTP NOW EXPLOITED IN ATTACKS

Summary from the TLDR InfoSec newsletter

File transfer software CrushFTP has warned users of a critical vulnerability that could lead to unauthorized access. Following a detailed write up by Project Discovery that included proof-of-concept exploit code, CISA and others are reporting that the vulnerability is being actively exploited. CrushFTP recommends enabling the DMZ zone feature if administrators cannot update the software right away.