CVE-2025-54309
CVE-2025-54309
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
CVSS 9.0 · Critique · EPSS 93,5% · Dans le catalogue KEV · Code d’exploitation public · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
crushftp
- Versions du logiciel
- ≥ 10, < 10.8.5: Concernée (custom)
- ≥ 11, < 11.3.4_23: Concernée (custom)
Mettez à jour vers 10.8.5; Mettez à jour vers 11.3.4_23
Sources originales
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025
- https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/
- https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/
- https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309
- https://nvd.nist.gov/vuln/detail/CVE-2025-54309