The article describes a method for detecting exploitation of a critical CrushFTP vulnerability (CVE-2025-31161, CVSS 9.8) using PacketSmith's Yara module with new `track_state` and `flow_state` keywords. The vulnerability affects CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0. The NVD data indicates the fixes are available in versions 10.8.4 and 11.3.1.
Head over to Netomize's blog to learn about how we detect the exploitation of the CrushFTP Vulnerability (CVE-2025-31161) with PacketSmith's Yara detection module, using the newly introduced track_state and flow_state keywords to the correlation engine. submitted by /u/MFMokbel [link] [comments]