{"id":"CVE-2025-54309","published":"2025-07-18T19:15:25Z","modified":"2026-06-17T09:39:49Z","title":"CrushFTP Unprotected Alternate Channel Vulnerability","vendor":"CrushFTP","product":"CrushFTP","tier":"core","eol":null,"description":{"text":"CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.","provenance":"source","from":"NVD"},"summary":{"text":"CrushFTP's AS2 validation flaw affects CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23 when the DMZ proxy feature is not in use. An attacker with network access to the HTTPS interface can gain administrative access without authentication or user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:44Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.93473,"percentile":0.99838,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-07-22","dueDate":"2025-08-12","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 ; https://nvd.nist.gov/vuln/detail/CVE-2025-54309 ","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-07-18","exploitedFirstSeen":"2025-07-18","ransomware":false,"evidence":[{"url":"https://arcticwolf.com/resources/blog/cve-2025-54309-critical-zero-day-vulnerability-in-crushftp-exploited/","date":"2025-07-18"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54309","date":"2025-07-18"},{"url":"https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025","date":"2025-07-18"},{"url":"https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/","date":"2025-07-18"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-07-22"},{"url":"https://8813571.fs1.hubspotusercontent-na1.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250812.pdf","date":"2025-08-12"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-54309","date":"2025-08-25"},{"url":"https://labs.watchtowr.com/the-one-where-we-just-steal-the-vulnerabilities-crushftp-cve-2025-54309/","date":"2025-08-27"},{"url":"https://projectdiscovery.io/blog/from-detection-to-validation-fixing-broken-vulnerability-workflows","date":"2025-10-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-10-10&host_type=src&vulnerability=cve-2025-54309","date":"2025-10-10"}],"evidenceTotal":83,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-420","name":"Unprotected Alternate Channel"}],"references":[{"url":"https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/","tags":["Press/Media Coverage"]},{"url":"https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025","tags":["Vendor Advisory"]},{"url":"https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/","tags":["Press/Media Coverage"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability","tags":["Third Party Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"exploitation_technique","evidence":[],"comment":"Improper validation of AS2 messages in CrushFTP without DMZ proxy enabled were reported to be exploited to bypass authentication and gain administrative access over HTTPS, leading to system compromise, data exfiltration, and lateral movement.","confidence":"high"},{"id":"T1567","name":"Exfiltration Over Web Service","tactics":["exfiltration"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"Improper validation of AS2 messages in CrushFTP without DMZ proxy enabled were reported to be exploited to bypass authentication and gain administrative access over HTTPS, leading to system compromise, data exfiltration, and lateral movement.","confidence":"high"},{"id":"T1021","name":"Remote Services","tactics":["lateral-movement"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"Improper validation of AS2 messages in CrushFTP without DMZ proxy enabled were reported to be exploited to bypass authentication and gain administrative access over HTTPS, leading to system compromise, data exfiltration, and lateral movement.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-21909","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-21909","exploited":true,"exploitedSince":"2025-07-22","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":6,"skipped":1,"earliest":"2025-08-25","earliestUrl":"https://github.com/watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309","repos":[{"name":"watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309","url":"https://github.com/watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309","stars":28,"created":"2025-08-25"},{"name":"foregenix/CVE-2025-54309","url":"https://github.com/foregenix/CVE-2025-54309","stars":2,"created":"2025-09-03"},{"name":"whisperer1290/CVE-2025-54309__Enhanced_exploit","url":"https://github.com/whisperer1290/CVE-2025-54309__Enhanced_exploit","stars":1,"created":"2025-09-06"},{"name":"0xLittleSpidy/CVE-2025-54309","url":"https://github.com/0xLittleSpidy/CVE-2025-54309","stars":1,"created":"2026-01-27"},{"name":"blueisbeautiful/CVE-2025-54309","url":"https://github.com/blueisbeautiful/CVE-2025-54309","stars":0,"created":"2025-08-29"}]},"first":{"date":"2025-08-25","source":"PoC-in-GitHub","url":"https://github.com/watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309"},"provenance":"source"},"detections":{"cveRules":[{"title":"Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)","id":"0fdc7c7f-c690-4217-9ae3-31f5156eed72","level":"high","status":"experimental","path":"rules-emerging-threats/2025/Exploits/CVE-2025-54309/proc_creation_win_exploit_cve_2025_54309.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-54309/proc_creation_win_exploit_cve_2025_54309.yml","techniques":["T1059.001","T1059.003","T1068","T1190"]}]},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"source"},{"stage":"primary","techniques":["T1567"],"provenance":"source"},{"stage":"secondary","techniques":["T1021"],"provenance":"source"}],"timeline":[{"date":"2025-07-18","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54309","provenance":"source"},{"date":"2025-07-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://arcticwolf.com/resources/blog/cve-2025-54309-critical-zero-day-vulnerability-in-crushftp-exploited/","provenance":"source"},{"date":"2025-07-22","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-07-22","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-21909","provenance":"source"},{"date":"2025-08-25","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309","provenance":"source"}],"speed":{"daysToPublicExploit":38,"firstExploitFrom":"PoC-in-GitHub","daysToKev":4},"priority":{"score":69.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 469 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9984"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"6 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}