CVE-2025-54309

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-54309
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

9.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/ Press/Media Coverage
https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 Vendor Advisory
https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/ Press/Media Coverage
https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*
cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*
History

21 Oct 2025, 23:17

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309 -

21 Oct 2025, 20:20

Type Values Removed Values Added
References
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

21 Oct 2025, 19:21

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309 -

25 Sep 2025, 18:03

Type Values Removed Values Added
References () https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 - Third Party Advisory () https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 - Vendor Advisory
References () https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability - () https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability - Third Party Advisory
References () https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability - () https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability - Third Party Advisory

25 Sep 2025, 17:15

Type Values Removed Values Added
References
  • () https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability -
  • () https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability -

23 Jul 2025, 17:51

Type Values Removed Values Added
References () https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/ - () https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/ - Press/Media Coverage
References () https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 - () https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 - Third Party Advisory
References () https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/ - () https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/ - Press/Media Coverage
CPE cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*
First Time Crushftp crushftp
Crushftp

22 Jul 2025, 13:06

Type Values Removed Values Added
Summary
  • (es) CrushFTP 10 anterior a 10.8.5 y 11 anterior a 11.3.4_23, cuando no se utiliza la función de proxy DMZ, maneja incorrectamente la validación AS2 y, en consecuencia, permite a atacantes remotos obtener acceso de administrador a través de HTTPS, como se explotó en la naturaleza en julio de 2025.

19 Jul 2025, 01:15

Type Values Removed Values Added
References
  • () https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/ -
  • () https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/ -

18 Jul 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-18 19:15

Updated : 2025-10-21 23:17

NVD link : CVE-2025-54309

Mitre link : CVE-2025-54309

CVE.ORG link : CVE-2025-54309

JSON object : View

Products Affected

crushftp

  • crushftp
CWE
CWE-420

Unprotected Alternate Channel