檔案伺服器軟體CrushFTP存在零時差漏洞，攻擊者可逃脫虛擬檔案系統下載伺服器的系統檔案
· 2024-04-23
檔案伺服器軟體CrushFTP開發團隊近日針對用戶提出警告，有人利用零時差漏洞CVE-2024-4040從事攻擊行動，呼籲用戶儘速套用新版程式來進行修補
CrushFTP
4月19日檔案伺服器系統CrushFTP發布資安公告，指出他們發布10.7.1、11.1.0新版本程式，修補已遭利用的零時差漏洞CVE-2024-4040，呼籲用戶應儘速部署新版程式因應。
該公司指出，一旦攻擊者利用上述漏洞，就有機會逃脫使用者的虛擬檔案系統（Virtual File System，VFS），從而存取、下載伺服器的系統檔案，CVSS風險評分為7.7。
雖然開發團隊並未透過攻擊細節，但資安業者CrowdStrike指出，這項漏洞被用於針對性攻擊，對方鎖定美國企業組織的CrushFTP伺服器下手，研究人員根據取得的證據，認為駭客很可能基於政治目標收集情報。
Popular articles
Brazil Proposes Raising Gambling Tax Rate to 24%, With Revenue Allocated to Social Security and Healthcare
Regulation
Institutional Academy that exceeded expectations marked the opening of GAT CDMX
Online Game
Indiana online casino bill stalls in House committee
Regulation
Vietnam’s Controlled Gaming Shift Gains Ground, But Domestic Demand Still Lags
Southeast Asia
GAT Expo Puerto Rico Will Pulse with the New Era of Gaming in the Caribbean
Marketing
Online gambling, crypto pose ongoing money laundering risks in Philippines, analyst says
Southeast Asia
Full House at GAT Expo Cartagena 2026 Academic Agenda
Online Game
Are you ready to maximize your earnings? Try ProPush.me Constructor!
Marketing
Super PAC Raises $48 Million: Sports Betting Forces Ramp Up Political Push
Regulation
That’s a Wrap: AffPapa Conference Madrid 2026 Highlights
Online Game
Gaming & Technology Expo Makes a Powerful Entrance in CDMX
Marketing
B2B Tech Infrastructure Gains Momentum in Philippine Gaming Sector
Southeast Asia
What’s on the SBC Summit Conference Agenda in 2026?
Marketing
1spin4win releases unique slot Don Catleone Hold and Win featuring gangster cats
Online Game
Kazakhstan plans to penalise online casino promotions
Regulation
