CVE-2025-54309
Published 2025-07-18 · Updated 2026-06-17 · Source cve@mitre.org
Summary
CVE-2025-54309 is a critical-severity (CVSS 9.0) vulnerability in CrushFTP CrushFTP. CISA added it to the Known Exploited Vulnerabilities catalog on July 22, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by August 12, 2025. CISA does not currently list it as used in ransomware campaigns. CrushFTP has 3 vulnerabilities in the KEV catalog, 1 of them linked to ransomware.
All 3 known-exploited CrushFTP vulnerabilities →Description
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: CrushFTP — CrushFTP
Name: CrushFTP Unprotected Alternate Channel Vulnerability
Date added: 2025-07-22 · Due: 2025-08-12
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
References
- https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025
- https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/
- https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309