Storm Watch | Cyber Podcast | 2025 Cyber Breakdown: CrushFTP Chaos, NVD Crisis & North Korean Threats
Summary: A critical CrushFTP auth bypass flaw that emerged in March 2025 received two separate CVE identifiers, CVE-2025-2825 and CVE-2025-31161, assigned by competing firms VulnCheck and Outpost24, while Shadowserver initially tracked over 1,800 vulnerable instances. The National Vulnerability Database faces a 32% surge in submissions despite processing CVEs at pre-2024 rates, and Google's threat team found North Korean IT workers managing 12 or more fake personas across Europe and the US targeting defense contractors and governments.
Why it matters: Two competing CVE identifiers for one actively exploited flaw left defenders reconciling conflicting tracking while more than 1,800 instances sat exposed, and a 32% submission surge is pushing older CVEs into deferred status where legacy systems may go unseen.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-2825CVE-2025-31161
- Related
- CVE-2025-31161: CrushFTP Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Apr 07, 2025Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026