CRITICAL

CVE-2025-54309

Crushftp Crushftp 2025-07-18 CVSS v3.1

CVSS

9.8

KEV

Description

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

Summary dbcve.org

CrushFTP versions 10 before 10.8.5 and 11 before 11.3.4_23 improperly validate AS2 (Applicability Statement 2) protocol requests when the DMZ proxy feature is disabled. This validation flaw allows unauthenticated remote attackers to bypass authentication checks and obtain administrative access via HTTPS, leading to full system compromise.

Mitigation

Upgrade CrushFTP to version 10.8.5 or 11.3.4_23 or later. If immediate patching is not feasible, ensure the DMZ proxy feature is enabled as a compensating control, though upgrading is strongly recommended given the in-the-wild exploitation.

Weakness (CWE)

CWE-420

EPSS Score

94.91%

Probability of exploitation in next 30 days

99.9th percentile

References

https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/ Press/Media Coverage https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 Vendor Advisory https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/ Press/Media Coverage https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability Third Party Advisory https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE