CVE-2025-54309

Published Jul 18, 2025

Last updated 4 months ago

Exploit known CVSS critical 9.0

FTP

CrushFTP

Port (21)

Overview

Description: CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
Source: cve@mitre.org
NVD status: Analyzed
Products: crushftp

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: CrushFTP Unprotected Alternate Channel Vulnerability
Exploit added on: Jul 22, 2025
Exploit action due: Aug 12, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

cve@mitre.org: CWE-420

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A4950EA3-D20F-48B4-BE81-8018EFB452D8",
            "versionEndExcluding": "10.8.5",
            "versionStartIncluding": "10.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "BDC2BCC0-AEA5-4A35-BCAD-6287574D4ED5",
            "versionEndExcluding": "11.3.4_23",
            "versionStartIncluding": "11.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References