CVE-2025-54309

🔥 Known Exploited (CISA KEV)CRITICAL

9.0

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-07-18

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

Affected Platforms (CPE)

📦

Crushftp

>= 10.0.0 and < 10.8.5>= 11.0.0 and < 11.3.4_23

References & Advisories

🔗 https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/

🔗 https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025

🔗 https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/

🔗 https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability

🔗 https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309

Vulnerability Description

Affected Platforms (CPE)

Crushftp

References & Advisories

相關漏洞威脅