CVE-2023-43177: CrushFTP unauthenticated command execution via attacker-controlled attributes
The short version: CrushFTP — a managed file-transfer server — has a flaw (CVE-2023-43177) in how it handles dynamically-determined object attributes that an unauthenticated attacker can abuse to reach control of the server, including command execution. It scores 9.8. It is not currently listed in CISA's KEV catalog, but a fix exists and file-transfer servers are exactly the kind of internet-facing, data-holding system attackers hunt. Patch promptly. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated and severe on paper; not currently KEV-listed |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~81.8% · 99.6th percentile (2026-07-17) |
| In CISA KEV? | No — not listed at time of writing |
| Known exploited? | Not confirmed in CISA KEV; public disclosure and analysis exist. Treat as a prompt-patch item. |
| Vulnerability type | CWE-913 improper control of dynamically-managed code resources (attacker-controlled object attributes) → unauthenticated command execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | CrushFTP before 10.5.2 |
| Fixed in | CrushFTP 10.5.2 (or later) |
What you need to know
CrushFTP is a managed file-transfer server that's typically internet-facing so users can move files. CVE-2023-43177 stems from improperly controlled modification of dynamically-determined object attributes — in short, an unauthenticated attacker can influence internal object state in a way that leads to control over the server, up to command execution.
A few points to keep in view:
- It's unauthenticated and network-reachable. No credential required, and the web interface is exposed by design.
- The product class is the draw. File-transfer servers hold sensitive data, so bugs in them are prized — CrushFTP has had multiple serious flaws.
- The exploitation picture is more measured here. Unlike its CrushFTP siblings (e.g. CVE-2024-4040), this one is not in CISA's KEV catalog at time of writing. It's severe on paper and worth patching promptly, but we're honest that confirmed, catalog-level in-the-wild exploitation isn't established.
How serious we see it
High — we land just below the on-paper 9.8, and the reason is exploitation evidence, not mechanics. An unauthenticated path to command execution on an internet-facing file server is genuinely dangerous, which is why this isn't "Moderate." But it isn't currently KEV-listed the way its siblings are, so we don't stamp it Critical on severity-take grounds alone. The reassuring part: it's bounded and fixable — a single fixed version (10.5.2) resolves it, and confirming your version is quick.
Recommendations
Straight from CrushFTP's guidance:
- Patch promptly. Upgrade to CrushFTP 10.5.2 or later (and keep current — CrushFTP has shipped several security fixes since).
- Reduce exposure. Restrict the CrushFTP interface to trusted networks where feasible; don't expose admin functions publicly.
- Hunt. Review CrushFTP and web logs for unexpected requests, new accounts, and anomalous administrative activity.
- If compromised, respond. Rotate credentials and keys, review what files were reachable, and rebuild if warranted.
- Confirm your exposure first. Verify whether you run CrushFTP and which version.
How BreachRisk sees it
BreachRisk works from the outside in. Starting from little more than your domain, it discovers internet-facing CrushFTP servers, fingerprints the product and version, and flags exposure tied to known vulnerabilities like this one so it's ranked and visible rather than lost in a scanner backlog.
Managed file-transfer servers are recurring targets because they hold the data; a continuous, attacker's-eye view means an exposed CrushFTP is already mapped, so you can prioritize patching before a proof-of-concept becomes a campaign.