Back to Database
Status published
Critical
CVE-2025-54309
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the...
Vulnerability Description
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54309
Credits & Attribution
No credits recorded in the NVD database.
References
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025
- https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/
- https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/
- https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability
More from CrushFTP
View All →CVE-2025-32103
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1...
Medium
5
CVE-2025-32102
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1...
Medium
5
CVE-2025-31161
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication...
Critical
9.8
CVE-2024-4040
Unauthenticated arbitrary file read and remote code execution in CrushFTP
Critical
9.8
Affected Vendor
CrushFTP
View all reports →Affected Software
CrushFTP
Vulnerable Versions:
10, 11
Timeline
Official Publish:
July 18th, 2025
Last Modified:
October 21st, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.