← CVE Radar
CVE-2025-54309 CrushFTP Unprotected Alternate Channel Vulnerability
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
9.8 CRITICALEPSS 93.47%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 9.0 | CRITICAL | 3.1mitre (CNA) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
CISA required action
⚡ Known exploited · remediation due Aug 12, 2025
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2025-54309
- Status
- Analyzed
- Assigner (CNA)
- mitre
- Published
- Jul 18, 2025
- Last modified
- 2026-06-17 09:39 UTC
- Weaknesses
- CWE-420 · Unprotected Alternate Channel
Affected Products
As published by the CNA in the CVE record.
CrushFTPCrushFTP2 version ranges
- 10 before 10.8.5
- 11 before 11.3.4_23
References
- bleepingcomputer.com https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/
- crushftp.com https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025
- rapid7.com https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/
- vicarius.io https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability
- vicarius.io https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309