Heise.De

Monsta FTP Remote Code Execution Vulnerability CVE-2025-34299 Discovered

First seen 23 Nov 2025, 03:35 UTC • Heise.De

•55.5

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A critical remote code execution vulnerability (CVE-2025-34299) has been identified in Monsta FTP, a web-based file transfer client, allowing unauthenticated attackers to execute arbitrary code on affected systems. The flaw arises from improper handling of user input during file downloads, endangering thousands of servers. Researchers have confirmed that this vulnerability is being actively exploited in the wild.

How this analysis works

Attack Flow

9 entities, 10 inferred relationships (STIX 2.1).

Technique (1)

Data Breach

Organization (3)

Logitech
Washington Post
MOVEit Transfer

Vulnerability (3)

CVE-2022-31827
CVE-2025-34299
SSRF

Affected Platform (1)

Monsta FTP

Threat Actor (1)

Cl0p

Relationships

Cl0p uses Data Breach
Cl0p exploits CVE-2022-31827
Cl0p exploits CVE-2025-34299
Cl0p exploits SSRF
CVE-2022-31827 targets Monsta FTP
CVE-2025-34299 targets Monsta FTP
SSRF targets Monsta FTP
Cl0p targets Logitech
Cl0p targets Washington Post
Cl0p targets MOVEit Transfer

Continue Reading

Logitech Confirms Data Breach from Zero-Day Exploit by Clop Gang Washington Post Confirms Breach from Oracle EBS Attacks by Cl0p Ransomware Gang Cl0p Ransomware Group Claims Data Theft from Nearly 50 Companies EU Sanctions Russia Over Ongoing Cyber Espionage Campaign ShinyHunters Exploits Oracle PeopleSoft Zero-Day Vulnerability AI-Generated Exploits Target Siemens PLCs in Critical Infrastructure

Monsta FTP Remote Code Execution Vulnerability CVE-2025-34299 Discovered

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading