by Kastro
Paper/Archive/CVE-2025-54309

CVE-2025-54309

CrushFTP CrushFTP — CrushFTP Unprotected Alternate Channel Vulnerability

KEV · due 12 AugEPSS 93%public exploitSSVC actCVSS 9.0
critical.is priorityof 100
97
CVSS 9.0 (CNA)9.0 / 10 × 3027.0In CISA KEV+3030.0EPSS percentile 99.8.998 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

Affected

ProductAffectedFixed inSource
CrushFTP10 – < 10.8.510.8.5CNA
CrushFTP11 – < 11.3.4_2311.3.4_23CNA

Scores by source

mitre (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

refcrushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025refrapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wildrefbleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-serversrefvicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerabilityrefvicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerabilityrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309kevcisa.gov/known-exploited-vulnerabilities-catalog