CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows
Affects CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23 when the DMZ proxy feature is not used. No vendor rating is given; CVSS scores it 9.0 critical. Fixed in 10.8.5 and 11.3.4_23.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 10.8.5, 11.3.4_23
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
CrushFTP, a file transfer server software, is affected when its DMZ proxy feature is not in use. Remote attackers could exploit a flaw in how it validates AS2 requests to gain administrator access over HTTPS.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- CrushFTP CrushFTP
From 10 · fixed in 10.8.5; From 11 · fixed in 11.3.4_23
References 5
crushftp.com
bleepingcomputer.com
Questions about CVE-2025-54309
What does this mean?
CrushFTP mishandles AS2 validation, which allows attackers to gain administrative access through the web interface on vulnerable servers.Source: crushftp.com, bleepingcomputer.com
Am I affected, and how do I check?
Affected are CrushFTP 10 before 10.8.5 and CrushFTP 11 before 11.3.4_23 when the DMZ proxy feature is not used; an enterprise DMZ CrushFTP in front of the main server is not affected. To check a server, compare its installed version with these ranges and confirm whether the DMZ proxy feature is in use.Source: crushftp.com, bleepingcomputer.com
What should I do about it?
Upgrade to CrushFTP 10.8.5 or later in the 10 line, or to 11.3.4_23 or later in the 11 line.Source: crushftp.com, bleepingcomputer.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-07-22, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data