CVE-2023-43177

EPSS 81.8%◆ VulnCheck KEV

Vexday Risk Score

82Fix now

SSVC decision (CISA)

Act

Exploitation + impact → act immediately

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 81.8%KEV nãoPoC públicaNuclei simMetasploit simPatch —

Lifecycle

08 Aug 2023Metasploit module available

17 Nov 2023Published on NVD

27 Dec 2023Public PoC

Weaponization speed

40 daysto first PoC

Recommendation: Patch as soon as possible — active exploitation confirmed.

CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.

Affected products

public PoCs found — 1

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References