CVE-2025-54309

Published Jul 18, 2025

Last updated 2 months ago

CrushFTP

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-54309 is a vulnerability in CrushFTP versions before 10.8.5 and 11.3.4_23. It stems from improper validation of the AS2 (Applicability Statement 2) protocol over HTTPS when the DMZ proxy feature is not in use. This mishandling allows unauthenticated remote attackers to gain administrative access to the system. Specifically, the server fails to correctly validate remote requests made to AS2 endpoints, which allows attackers to forge requests that the system interprets as coming from a trusted source, bypassing authentication checks. By sending malicious AS2 payloads over HTTPS to the exposed CrushFTP endpoint, an attacker can send administrative commands and potentially escalate privileges to execute arbitrary commands.

Description: CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
Source: cve@mitre.org
NVD status: Analyzed
Products: crushftp

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: CrushFTP Unprotected Alternate Channel Vulnerability
Exploit added on: Jul 22, 2025
Exploit action due: Aug 12, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

cve@mitre.org: CWE-420

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A4950EA3-D20F-48B4-BE81-8018EFB452D8",
            "versionEndExcluding": "10.8.5",
            "versionStartIncluding": "10.0.0"
          },
          {
            "criteria": "cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BDC2BCC0-AEA5-4A35-BCAD-6287574D4ED5",
            "versionEndExcluding": "11.3.4_23",
            "versionStartIncluding": "11.0.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.