Every CVE Search/ Get API key

CVE-2025-54309

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used,...

9.0 CriticalIn KEVPublic exploit

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

93.5%Up 93.4 points since Jul 19, 2025
90%50%10%1%

What each source reports

CVE List Score used 9.0

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

Record
CVE-2025-54309
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-420
Updated
2026-11-02
EUVDEUVD-2025-21909 9.0

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

Record
EUVD-2025-21909
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-rh5q-v9ww-rqgm 9.0

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used,...

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

Record
GHSA-rh5q-v9ww-rqgm
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-420
Updated
2026-11-02
CISA KEV No score

CrushFTP Unprotected Alternate Channel Vulnerability

CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.

Record
CVE-2025-54309
Weakness
CWE-420
Updated
2026-11-02
NVD 9.0

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

Record
CVE-2025-54309
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-420
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubwatchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-543092025-08-25
PoC in GitHubblueisbeautiful/CVE-2025-543092025-08-29
PoC in GitHubforegenix/CVE-2025-543092025-09-03
PoC in GitHubwhisperer1290/CVE-2025-54309__Enhanced_exploit2025-09-06
PoC in GitHubchin-tech/CrushFTP_CVE-2025-543092025-09-13
PoC in GitHubGoodworkid0/CrushFTP-AS2-Bypass-Research-CVE-2025-543092025-12-06
PoC in GitHub0xLittleSpidy/CVE-2025-543092026-01-27

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-54309 is a critical vulnerability (CVSS 9.0) in Crushftp, published July 18, 2025. CISA lists it as known to be exploited, since July 22, 2025. EUVD reports exploitation since July 22, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 93.5%, the 99th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open