CVE-2025-54309: critical vulnerability in CrushFTP
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CrushFTP versions before 10.8.5 and 11.3.4_23 have a flaw in how they validate AS2 (a secure file transfer protocol) when the DMZ proxy feature is disabled, allowing attackers to gain administrator access over HTTPS without proper authentication.
CrushFTP improperly validates AS2 requests when DMZ proxy is not enabled, allowing unauthenticated remote attackers to bypass authentication mechanisms and obtain administrative privileges via HTTPS. The vulnerability affects versions 10.x before 10.8.5 and 11.x before 11.3.4_23, with active exploitation observed in July 2025.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.