Unauthenticated CrushFTP Zero-Day Enables Complete Server Compromise

CVE-2024-4040 is an unauthenticated zero-day vulnerability in managed file transfer software CrushFTP. Successful exploitation allows for arbitrary file read as root, authentication bypass for administrator account access, and remote code execution.

access account account access administrator authentication authentication bypass bypass code code execution compromise crushftp cve cve-2024 emergent threat response exploitation file file transfer managed managed file transfer remote code remote code execution root server software transfer unauthenticated vulnerability vulnerability management zero-day zero-day vulnerability