Servers and applications
CVE-2025-54309
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 22 Jul 2025.
- Severity
- Critical 9.8
- Published
- 18 Jul 2025
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 10.8.5, 11.3.4_23
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
CrushFTPServers and applications · cpe:a:crushftp:crushftp |
|
Known exploited
- CISA name
- CrushFTP Unprotected Alternate Channel Vulnerability
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Due for US agencies
- 12 Aug 2025
- Used in ransomware
- Not known