Critical severity9.0CISA KEVNVD Advisory· Published Jul 18, 2025· Updated Jun 17, 2026

CVE-2025-54309

Description

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Crushftp/Crushftp3 versions
cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*range: >=10.0.0,<10.8.5
- (no CPE)range: <10.8.5, <11.3.4_23
- (no CPE)range: 10

Patches

Vulnerability mechanics

References

www.crushftp.com/crush11wiki/Wiki.jspnvdVendor Advisory
www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerabilitynvdThird Party Advisory
www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerabilitynvdThird Party Advisory
www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/nvdPress/Media Coverage
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/nvdPress/Media Coverage

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.075
exploit	0.000
kev	0.120
patch	0.000
ransomware	0.000