CVE-2025-54309
CVE-2025-54309
This page contains facts from public vulnerability sources. Check the original advisory before updating.
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
CVSS 9.0 · Critical · EPSS 93.5% · In KEV · Public exploit · Fix available
- Published
- Updated
Affected products and versions
crushftp
- Versions
- ≥ 10, < 10.8.5: Affected (custom)
- ≥ 11, < 11.3.4_23: Affected (custom)
Update to 10.8.5; Update to 11.3.4_23
Original sources
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025
- https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/
- https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/
- https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309
- https://nvd.nist.gov/vuln/detail/CVE-2025-54309