CVE-2025-54309

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

CVSS v3 9.0 CRITICAL

9.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.2 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/	Press/Media Coverage
https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025	Vendor Advisory
https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/	Press/Media Coverage
https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability	Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability	Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309	US Government Resource

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:crushftp:crushftp::::::::
	cpe:2.3:a:crushftp:crushftp::::::::

History

05 Nov 2025, 19:25

Type	Values Removed	Values Added
References	~~() https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309 -~~	() https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309 - US Government Resource

Information

Published : 2025-07-18 19:15

Updated : 2025-11-05 19:25

NVD link : CVE-2025-54309

Mitre link : CVE-2025-54309

CVE.ORG link : CVE-2025-54309

JSON object : View

Products Affected

crushftp

crushftp

CWE

CWE-420

Unprotected Alternate Channel

{"id": "CVE-2025-54309", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-07-18T19:15:25.353", "references": [{"url": "https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/", "tags": ["Press/Media Coverage"], "source": "[email protected]"}, {"url": "https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/", "tags": ["Press/Media Coverage"], "source": "[email protected]"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309", "tags": ["US Government Resource"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-420"}]}], "descriptions": [{"lang": "en", "value": "CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025."}, {"lang": "es", "value": "CrushFTP 10 anterior a 10.8.5 y 11 anterior a 11.3.4_23, cuando no se utiliza la funci\u00f3n de proxy DMZ, maneja incorrectamente la validaci\u00f3n AS2 y, en consecuencia, permite a atacantes remotos obtener acceso de administrador a trav\u00e9s de HTTPS, como se explot\u00f3 en la naturaleza en julio de 2025."}], "lastModified": "2025-11-05T19:25:42.887", "cisaActionDue": "2025-08-12", "cisaExploitAdd": "2025-07-22", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4950EA3-D20F-48B4-BE81-8018EFB452D8", "versionEndExcluding": "10.8.5", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDC2BCC0-AEA5-4A35-BCAD-6287574D4ED5", "versionEndExcluding": "11.3.4_23", "versionStartIncluding": "11.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]", "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "cisaVulnerabilityName": " CrushFTP Unprotected Alternate Channel Vulnerability"}