CrushFTP · CrushFTP
CVE-2025-54309
CrushFTP Unprotected Alternate Channel Vulnerability
What it is
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
CISA: CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: August 12, 2025
- Added to the CISA list
- July 22, 2025
- Published
- July 18, 2025
- Severity
- Critical 9.0 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 93% in the top 0.2% of all known vulnerabilities
- Weakness
- CWE-420
- More details
- NVD · CVE.org · CISA
All references (5)
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025
- https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/
- https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on…
- https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability
More exploited flaws from CrushFTP
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Apr 7, 2025 | Authentication Bypass | CrushFTP | Critical 9.8 | >99.9% |
| Apr 24, 2024 | VFS Sandbox Escape | CrushFTP | Critical 9.8 | 99.5% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.