VULNERABILITY INTELLIGENCE

CVE-2025-54309

CVSS score9 CRITICAL
EPSS probability93.47%
CISA KEVKnown exploited vulnerability
Published2025-07-18
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Known Exploited Vulnerability

CrushFTP Unprotected Alternate Channel Vulnerability

Vendor / product: CrushFTP / CrushFTP

Description

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

Weakness classification

  • cve@mitre.org: CWE-420

Primary references