CVE-2025-54309
CrushFTP Unprotected Alternate Channel Vulnerability
Description
CVE-2025-54309 is a critical authentication bypass vulnerability in CrushFTP file transfer server that enables remote attackers to obtain administrative access via HTTPS. The flaw stems from mishandled AS2 validation logic in CrushFTP 10 before 10.8.5 and CrushFTP 11 before 11.3.4_23 when the DMZ proxy feature is not used. With a CVSS v3.1 base score of 9.0 (Critical), this vulnerability was exploited in the wild as a zero-day in July 2025 before patches were available. CISA has added CVE-2025-54309 to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 12, 2025, and its extraordinary EPSS score of 72.80% at the 98th percentile underscores the extreme exploitation probability facing organizations running unpatched CrushFTP instances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| crushftp | crushftp | >= 10.0.0, < 10.8.5; >= 11.0.0, < 11.3.4_23 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/(Press/Media Coverage)
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025(Vendor Advisory)
- https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/(Press/Media Coverage)
- https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309(US Government Resource)
Weakness Type
CWE-420: Unprotected Alternate Channel
CVE-2025-54309 is classified under CWE-420, which describes vulnerabilities where a product protects its primary channel but leaves an alternate channel unprotected. In CrushFTP, when the DMZ proxy feature is not enabled, the AS2 (Applicability Statement 2) protocol validation logic contains a flaw that exposes an alternate authentication path. This unprotected channel allows remote attackers to bypass the intended authentication mechanism entirely and gain direct administrative access to the CrushFTP server through HTTPS requests that exploit the AS2 validation weakness.
Learn more: CWE-420 — Unprotected Alternate Channel
Impact Analysis
CVE-2025-54309 carries a CVSS v3.1 base score of 9.0 (Critical) with devastating real-world consequences. The vulnerability is network-accessible (AV:N) and while the attack complexity is rated high (AC:H) due to the specific configuration requirement (DMZ proxy not enabled), it requires no authentication (PR:N) and no user interaction (UI:N). The changed scope (S:C) indicates that exploitation affects resources beyond the CrushFTP application itself. All three CIA dimensions face maximum impact: Confidentiality (High) means all files managed by CrushFTP become accessible, Integrity (High) allows the attacker to modify server configurations and user accounts, and Availability (High) enables complete service disruption. The confirmed zero-day exploitation in July 2025 and an EPSS score of 72.80% at the 98th percentile place this among the most dangerous file transfer vulnerabilities of the year. File transfer servers have become prime targets for ransomware groups and data extortion campaigns.
Exploit Maturity
CVE-2025-54309 was exploited as a zero-day vulnerability in the wild in July 2025 before patches were available, demonstrating maximum exploit maturity. CISA has confirmed active exploitation through inclusion in the KEV catalog. Multiple detailed analyses have been published, including the CrushFTP vendor advisory and coverage from Rapid7 and BleepingComputer. The EPSS score of 72.80% at the 98th percentile indicates near-certain exploitation, placing it in the top 2% of all vulnerabilities by exploitation probability. CrushFTP has been repeatedly targeted in recent years, with this CVE following the pattern of high-impact vulnerabilities in file transfer platforms that are exploited by sophisticated threat actors for data theft and extortion.
Remediation
-
Upgrade CrushFTP immediately. Update CrushFTP 10 to version 10.8.5 or later, or CrushFTP 11 to version 11.3.4_23 or later. Consult the CrushFTP compromise advisory for detailed upgrade instructions and compromise indicators.
-
Enable the DMZ proxy feature. If not already configured, enable the CrushFTP DMZ proxy as the vulnerability only affects installations where this feature is not in use. The DMZ proxy provides an additional security layer that prevents direct exploitation of the AS2 validation flaw.
-
Conduct forensic investigation. Given the confirmed zero-day exploitation, assume compromise if CrushFTP was exposed without the DMZ proxy. Review access logs for unauthorized administrative sessions, check for new or modified user accounts, examine file transfer logs for bulk data downloads, and inspect the server for backdoors or persistence mechanisms.
-
Restrict network access. Implement firewall rules to limit HTTPS access to CrushFTP administrative interfaces to trusted IP ranges only. Consider placing CrushFTP behind a reverse proxy with additional authentication requirements.
-
Monitor for ongoing threats. Implement network-level monitoring for anomalous outbound data transfers and unexpected administrative actions. File transfer platforms remain high-value targets, and patched instances should be continuously monitored for new exploitation techniques.
Technical Details
CVE-2025-54309 is an authentication bypass vulnerability in CrushFTP with the CVSS v3.1 vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. The vulnerability resides in the AS2 (Applicability Statement 2) validation logic, a protocol commonly used for B2B file transfers. When the DMZ proxy feature is not enabled, CrushFTP's handling of AS2 protocol validation contains a logic flaw that creates an unprotected alternate authentication channel. An attacker can craft specific HTTPS requests that exploit this miscondition to bypass the normal authentication flow entirely, gaining administrative access to the CrushFTP server without providing valid credentials. The high attack complexity (AC:H) reflects the prerequisite that the target must not have the DMZ proxy enabled, though this is a common deployment configuration. The changed scope indicates that administrative access to CrushFTP enables control over the underlying host system, file repositories, and connected integrations. Affected versions include CrushFTP 10.0 through 10.8.4 and CrushFTP 11.0 through 11.3.4_22.
Frequently Asked Questions
Is CVE-2025-54309 being actively exploited?
Yes. CVE-2025-54309 was exploited as a zero-day in the wild in July 2025 before patches were available. CISA has confirmed active exploitation. The EPSS score of 72.80% at the 98th percentile indicates near-certain exploitation activity.
What products are affected by CVE-2025-54309?
CrushFTP 10 before version 10.8.5 and CrushFTP 11 before version 11.3.4_23 are affected when the DMZ proxy feature is not enabled. Installations using the DMZ proxy feature are not vulnerable to this specific attack vector.
How do I fix CVE-2025-54309?
Upgrade CrushFTP 10 to version 10.8.5+ or CrushFTP 11 to version 11.3.4_23+. Additionally, enable the DMZ proxy feature as a defense-in-depth measure. Given the zero-day exploitation, conduct a forensic review before or alongside patching.
How severe is CVE-2025-54309?
CVE-2025-54309 is rated Critical with a CVSS v3.1 score of 9.0. It enables unauthenticated administrative access to file transfer servers, which commonly store large volumes of sensitive data. The zero-day exploitation and 98th percentile EPSS ranking make this an urgent priority for remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.