Critical severity · published Jul 18, 2025
CVE-2025-54309
CrushFTP Unprotected Alternate Channel Vulnerability
In wildKEV
9.8
CVSS
93.5%
EPSS
Yes
On KEV
Description
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)93.5% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Jul 22, 2025
Federal remediation dueAug 12, 2025
Ransomware campaign useNot known
Affected products
Which versions
CR
CrushFTP · CrushFTP
10 before 10.8.5; 11 before 11.3.4_23 · source: vendor, NVD, KEV
In the news
VulnerabilityHigh
Bruteforce Scans for CrushFTP , (Tue, Mar 3rd)
CrushFTP is a Java-based open source file transfer system. It is offered for multiple operating systems. If you run a CrushFTP instance, you may remember that the software has had some serious vulnerabilities: CVE-2024-4040 (the template-injection flaw that let unauthenticated attackers escape the VFS sandbox and achieve RCE), CVE-2025-31161 (the auth-bypass that handed over the crushadmin account on a silver platter), and the July 2025 zero-day CVE-2025-54309 that was actively exploited in the wild. 
Mar 3, 2026·SANS Internet Storm Center
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-54309
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-54309
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
www.crushftp.com
https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025
www.rapid7.com
https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/
www.bleepingcomputer.com
https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/
www.vicarius.io
https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability
www.vicarius.io
https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability
More from CrushFTP
10.0
CVE-2024-4040
Unauthenticated arbitrary file read and remote code execution in CrushFTP
9.8
CVE-2025-31161
CrushFTP Authentication Bypass Vulnerability
9.8
CVE-2024-53552
CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover
9.8
CVE-2023-43177
CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes
9.8
CVE-2017-14035
CrushFTP 8.x before 8.2.0 has a serialization vulnerability