{"id":"CVE-2025-54309","aliases":["EUVD-2025-21909","GHSA-rh5q-v9ww-rqgm"],"status":"published","title":"CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used,...","description":"CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.","severity":{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.93473,"percentile":0.99841,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-420"],"published":"2025-07-18T00:00:00Z","modified":"2026-06-17T09:39:49Z","kev":{"date_added":"2025-07-22","due_date":"2025-08-12","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2025-07-22"},{"source":"kev","since":"2025-07-22"}],"exploits":[{"source":"pocgithub","id":"watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309","title":"watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309","date":"2025-08-25","url":"https://github.com/watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309"},{"source":"pocgithub","id":"blueisbeautiful/CVE-2025-54309","title":"blueisbeautiful/CVE-2025-54309","date":"2025-08-29","url":"https://github.com/blueisbeautiful/CVE-2025-54309"},{"source":"pocgithub","id":"foregenix/CVE-2025-54309","title":"foregenix/CVE-2025-54309","date":"2025-09-03","url":"https://github.com/foregenix/CVE-2025-54309"},{"source":"pocgithub","id":"whisperer1290/CVE-2025-54309__Enhanced_exploit","title":"whisperer1290/CVE-2025-54309__Enhanced_exploit","date":"2025-09-06","url":"https://github.com/whisperer1290/CVE-2025-54309__Enhanced_exploit"},{"source":"pocgithub","id":"chin-tech/CrushFTP_CVE-2025-54309","title":"chin-tech/CrushFTP_CVE-2025-54309","date":"2025-09-13","url":"https://github.com/chin-tech/CrushFTP_CVE-2025-54309"},{"source":"pocgithub","id":"Goodworkid0/CrushFTP-AS2-Bypass-Research-CVE-2025-54309","title":"Goodworkid0/CrushFTP-AS2-Bypass-Research-CVE-2025-54309","date":"2025-12-06","url":"https://github.com/Goodworkid0/CrushFTP-AS2-Bypass-Research-CVE-2025-54309"},{"source":"pocgithub","id":"0xLittleSpidy/CVE-2025-54309","title":"0xLittleSpidy/CVE-2025-54309","date":"2026-01-27","url":"https://github.com/0xLittleSpidy/CVE-2025-54309"}],"products":[{"vendor":"crushftp","product":"crushftp"}],"references":[{"url":"https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025","tags":["Vendor Advisory"]},{"url":"https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/","tags":["Press/Media Coverage"]},{"url":"https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/","tags":["Press/Media Coverage"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability","tags":["Third Party Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54309"},{"url":"https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers"},{"url":"https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild"},{"url":"https://github.com/advisories/GHSA-rh5q-v9ww-rqgm"}],"sources":{"cve":[{"id":"CVE-2025-54309","description":"CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.","status":"published","published":"2025-07-18T00:00:00Z","modified":"2025-10-21T22:45:21.853Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-420"],"updated_at":"2026-11-02T14:32:27.603809Z"}],"euvd":[{"id":"EUVD-2025-21909","description":"CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.","status":"published","published":"2025-07-18T00:00:00Z","modified":"2025-10-21T22:45:21Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2025-07-22","updated_at":"2026-11-02T20:31:29.313974Z"}],"ghsa":[{"id":"GHSA-rh5q-v9ww-rqgm","title":"CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used,...","description":"CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.","status":"published","published":"2025-07-18T21:30:30Z","modified":"2025-10-22T00:34:26Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-420"],"updated_at":"2026-11-02T15:04:09.266545Z"}],"kev":[{"id":"CVE-2025-54309","title":" CrushFTP Unprotected Alternate Channel Vulnerability","description":"CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.","cwes":["CWE-420"],"kev":{"date_added":"2025-07-22","due_date":"2025-08-12","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2025-54309","description":"CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.","status":"published","published":"2025-07-18T19:15:25.353Z","modified":"2026-06-17T09:39:49.643Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-420"],"updated_at":"2026-11-02T14:11:18.782156Z"}]}}