CVE-2025-54309
CrushFTP Unprotected Alternate Channel Vulnerability - [Actively Exploited]
Description
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
INFO
Published Date :
July 18, 2025, 7:15 p.m.
Last Modified :
Sept. 25, 2025, 6:03 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 ; https://nvd.nist.gov/vuln/detail/CVE-2025-54309
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | [email protected] | ||||
| CVSS 3.1 | CRITICAL | [email protected] |
Solution
- Update CrushFTP to version 10.8.5 or later.
- Update CrushFTP to version 11.3.4_23 or later.
- Ensure the DMZ proxy feature is configured if not updating.
Public PoC/Exploit Available at Github
CVE-2025-54309 has a 8 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-54309.
| URL | Resource |
|---|---|
| https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/ | Press/Media Coverage |
| https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 | Vendor Advisory |
| https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/ | Press/Media Coverage |
| https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability | Third Party Advisory |
| https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability | Third Party Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-54309 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-54309
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Python
None
Python
CrushFTP AS2 Authentication Bypass
Python
None
Python
CrushFTP Unauthenticated Remote Command Execution Exploit
Python
本项目借鉴了vulhub仓库的模式，用户只需执行一条docker命令即可轻松部署漏洞环境。
CISA Bot is a GitHub bot that automatically monitors the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog. When new vulnerabilities are published in the KEV, the bot creates GitHub issues in this repository with detailed information about each vulnerability.
Python
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-54309 vulnerability anywhere in the article.
-
Daily CyberSecurity
Unlocking Real-Time Translation: Microsoft Edge’s AI Breakthrough
Microsoft has introduced a highly practical new feature in its Edge browser: when users watch videos in English, the browser can leverage artificial intelligence to deliver real-time translation into ... Read more
-
Daily CyberSecurity
FTC Probes Google, Amazon Over ‘Opaque’ Ad Practices
The U.S. Federal Trade Commission (FTC) has launched a new investigation into the online advertising practices of Google and Amazon, focusing on the transparency of their auction pricing mechanisms an ... Read more
-
Daily CyberSecurity
Apple Issues New Spyware Alerts for French Officials and Journalists
Apple occasionally issues spyware attack notifications, publicly disclosing on its website which countries or regions have received such warnings. However, some spyware campaigns may remain undisclose ... Read more
-
Daily CyberSecurity
CVE-2025-10127 (CVSS 9.8): Critical Daikin Flaw Could Give Hackers Full System Access
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a security advisory about a critical flaw in Daikin Security Gateway devices that could allow attackers to bypass authentication ... Read more
-
Daily CyberSecurity
CVE-2025-58754: Axios Vulnerability Puts Node.js Processes at Risk of DoS Attacks
The Axios project has released a security advisory for a newly discovered vulnerability affecting its popular promise-based HTTP client for Node.js and browsers. Tracked as CVE-2025-58754 with a CVSS ... Read more
-
Daily CyberSecurity
CISA Urges Immediate Patching: Critical Dassault Systèmes Flaw (CVE-2025-5086) Actively Exploited
The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical flaw in Dassault Systèmes DELMIA Apriso to its Known Exploited Vulnerabilities (KEV) Catalog, following confirmed evide ... Read more
-
Daily CyberSecurity
Unveiling VoidProxy: The Phishing-as-a-Service That Bypasses MFA
Domain pattern for Google phishing pages | Image: Okta Okta Threat Intelligence has published a detailed analysis of VoidProxy, a previously unreported Phishing-as-a-Service (PhaaS) platform that repr ... Read more
-
Daily CyberSecurity
PyInstaller Flaw : Are Your Python Apps Vulnerable to Hijacking?
The PyInstaller project has released fixes for a local privilege escalation vulnerability that affected applications packaged with versions prior to 6.0.0. Tracked as CVE-2025-59042 with a CVSS score ... Read more
-
Daily CyberSecurity
Angular SSR Flaw (CVE-2025-59052) Exposes User Data: What Developers Need to Know
The Angular team has issued a security advisory addressing a high-severity flaw in server-side rendering (SSR) that could allow attackers to access sensitive data from unrelated requests. Tracked as C ... Read more
-
Daily CyberSecurity
Microsoft Copilot to Be Powered by Two AIs: OpenAI and Now Anthropic
The Information has reported that Microsoft is preparing to announce, within the coming weeks, the integration of Anthropic’s latest Claude model into selected Office 365 Copilot features. This marks ... Read more
-
Daily CyberSecurity
High-Severity Flaws in Sunshine for Windows Allow Privilege Escalation
The CERT Coordination Center (CERT/CC) has issued a vulnerability note warning of two critical local security flaws affecting Sunshine for Windows v2025.122.141614 and likely earlier versions. Sunshin ... Read more
-
Daily CyberSecurity
Beyond Cobalt Strike: A New Open-Source Hacking Tool Is on the Rise
Researchers at Palo Alto Networks’ Unit 42 have published a report detailing the rise of AdaptixC2, an open-source post-exploitation and adversarial emulation framework that is increasingly being abus ... Read more
-
Daily CyberSecurity
CVE-2025-8696: DoS Flaw in Stork UI Allows Unauthenticated Attackers to Crash Servers
The Internet Systems Consortium (ISC) has issued a security advisory addressing a high-severity flaw in Stork UI, a tool for monitoring and managing ISC DHCP and BIND installations. The vulnerability, ... Read more
-
Daily CyberSecurity
ACSC Warns of Active Exploitation of SonicWall SSL VPN Vulnerability (CVE-2024-40766)
The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) has issued an alert on the active exploitation of CVE-2024-40766, a critical vulnerability in SonicWall SSL VPNs that ... Read more
-
Daily CyberSecurity
CVE-2025-58063: CoreDNS Vulnerability Could Disrupt DNS Updates
The CoreDNS project has disclosed a vulnerability in its etcd plugin, tracked as CVE-2025-58063 (CVSS 7.1), which could allow attackers to pin DNS cache entries for abnormally long periods, effectivel ... Read more
-
Daily CyberSecurity
NVIDIA Patches High-Severity Vulnerabilities in NVDebug Tool
NVIDIA has released a software update for its NVDebug tool, addressing three high-severity vulnerabilities (CVE-2025-23342, CVE-2025-23343, and CVE-2025-23344) that could allow attackers to execute co ... Read more
-
Daily CyberSecurity
Apple’s “Most Significant Upgrade” to iPhone Security Is Here
Apple Security Engineering and Architecture (SEAR) has unveiled Memory Integrity Enforcement (MIE), an always-on, hardware-assisted memory safety technology designed to block entire classes of memory ... Read more
-
Daily CyberSecurity
The MacBook Pro Is Getting an OLED Display, But There’s a Catch
According to a report from South Korean outlet The Elec, Apple is preparing to adopt OLED displays in its upcoming MacBook Pro models, set for release next year, replacing the current mini-LED panels. ... Read more
-
Daily CyberSecurity
Sophos Fixes Critical Authentication Bypass (CVE-2025-10159) in AP6 Series Wireless Access Points
Sophos has released a fix for a critical authentication bypass vulnerability (CVE-2025-10159) affecting its AP6 Series Wireless Access Points. The flaw, rated CVSS 9.8, could allow attackers with netw ... Read more
-
Daily CyberSecurity
NVIDIA’s Newest Acquisition: The AI Programming Startup That’s Set to Reshape Development
NVIDIA has recently acquired Solver, an AI programming startup founded in 2022, as part of its strategy to strengthen its integrated ecosystem of hardware, software, and cloud services for AI developm ... Read more
The following table lists the changes that have been made to the
CVE-2025-54309 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Modified Analysis by [email protected]
Sep. 25, 2025
Action Type Old Value New Value Changed Reference Type MITRE: https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 Types: Third Party Advisory MITRE: https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 Types: Vendor Advisory Added Reference Type MITRE: https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability Types: Third Party Advisory Added Reference Type MITRE: https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability Types: Third Party Advisory -
CVE Modified by [email protected]
Sep. 25, 2025
Action Type Old Value New Value Added Reference https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability Added Reference https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability -
Initial Analysis by [email protected]
Jul. 23, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CPE Configuration OR *cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:* versions from (including) 10.0.0 up to (excluding) 10.8.5 *cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:* versions from (including) 11.0.0 up to (excluding) 11.3.4_23 Added Reference Type MITRE: https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/ Types: Press/Media Coverage Added Reference Type MITRE: https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 Types: Third Party Advisory Added Reference Type MITRE: https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/ Types: Press/Media Coverage -
CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725
Jul. 23, 2025
Action Type Old Value New Value Added Vulnerability Name CrushFTP Unprotected Alternate Channel Vulnerability Added Date Added 2025-07-22 Added Due Date 2025-08-12 Added Required Action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. -
CVE Modified by [email protected]
Jul. 19, 2025
Action Type Old Value New Value Added Reference https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/ Added Reference https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/ -
New CVE Received by [email protected]
Jul. 18, 2025
Action Type Old Value New Value Added Description CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025. Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H Added CWE CWE-420 Added Reference https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025