CVE-2025-54309
CrushFTP Unprotected Alternate Channel Vulnerability
CrushFTP CrushFTPNetwork & edge
CVSS
9.0CriticalExploit odds (EPSS)93.5%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
Description
CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.
Text from CVE List
Affected versions 2
- CrushFTPaffected: 10 before 10.8.5CVE List
- CrushFTPaffected: 11 before 11.3.4_23CVE List
References 7
- bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/Advisoryvia CVE List
- crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025Referencevia CVE List
- nvd.nist.gov/vuln/detail/CVE-2025-54309Referencevia CISA KEV
- rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/Referencevia CVE List
- vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerabilityReferencevia CVE List
- vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerabilityReferencevia CVE List
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309Referencevia CVE List