CVE-2025-54309

Published: Jul 18, 2025Modified: Jun 17, 2026CISA KEV

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

Affected (2)

Products: Crushftp: Crushftp

Crushftp

1 product

Crushftp

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Crushftp Crushftp	From 10.0.0 to 10.8.5
Crushftp Crushftp	From 11.0.0 to 11.3.4_23

Related CWEs

CWE-420

Unprotected Alternate Channel

The product protects a primary channel, but it does not use the same level of protection for an alternate channel.

References (6)

https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/

Source: cve@mitre.org

Press/Media Coverage

https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025

Source: cve@mitre.org

Vendor Advisory

https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/

Source: cve@mitre.org

Press/Media Coverage

https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability

Source: cve@mitre.org

Third Party Advisory

https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability

Source: cve@mitre.org

Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.