Critical vulnerability in CrushFTP file transfer server allows remote attackers to obtain admin access via HTTPS through mishandled AS2 validation. Actively exploited in the wild with large numbers of internet-facing instances vulnerable.
Data Source: CIRCL
Confidence: HIGH
Exploitation Method: DIRECT_NETWORK
CVE Published: 2025-07-18
Added to CISA KEV: 2025-07-22 4 DAYS BETWEEN CVE AND KEV
This vulnerability in the CrushFTP managed file transfer software web interface is being exploited in the wild.
Given the large number of exposed, internet-facing vulnerable instances and ongoing exploitation of the CVE-2025-54309, organizations are strongly urged to ...
A newly disclosed critical security flaw in CrushFTP has come under active exploitation in the wild. Assigned the CVE identifier CVE-2025-54309, the vulnerability carries a CVSS score of 9.0. "CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not...
ReliaQuest observed an attempted exploitation of CVE-2025-54309—a zero-day vulnerability in CrushFTP’s file transfer software.
Exploitation Methods CVE-2025-54309. To exploit this vulnerability, an attacker: Identifies a target CrushFTP instance that