CVE-2025-54309

high-risk
Published 2025-07-18

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

Do I need to act?

!
77.8% chance of exploitation in next 30 days
EPSS score — higher than 22% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.0/10 Critical
NETWORK / HIGH complexity

Affected Products (1)

Affected Vendors

Crushftp

References (6)

Press/Media Coverage https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-at...
Vendor Advisory https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025
Press/Media Coverage https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/
Third Party Advisory https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerabil...
Third Party Advisory https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerab...
US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-...
58
/ 100
high-risk
Severity 26/34 · High
Exploitability 27/34 · High
Exposure 5/34 · Minimal