CVE-2025-54309: CrushFTP AS2 validation flaw gives admin access over HTTPS
Exploited in the wild Critical 9.8 EPSS 93.5%
CrushFTP mishandles AS2 validation when the DMZ proxy feature is not used, letting remote attackers obtain admin access over HTTP(S). Attackers reverse-engineered an already-fixed bug and mass-exploited unpatched servers from 18 July 2025 (possibly a day earlier), creating rogue admin users. Fixed in 10.8.5 and 11.3.4_23 (11.3.5 and later are safe); CISA added it to KEV on 22 July 2025.
- CVE-2025-54309CVE identifier
- 9.8CVSS 3.1 base score (critical)
- 2025-07-22added to CISA's exploited list (US federal deadline 2025-08-12)
- 93.5%EPSS: chance of exploitation in the next 30 days (higher than 100% of CVEs)
- 2025-07-18published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run the affected software and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- CrushFTP 11 rarely needs a service restart after an update (vendor); restart the crushftp service if the version does not change.
- If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.
- Because this flaw is being exploited, also check the server for signs of compromise.
Affected and fixed versions
Affected:
- CrushFTP 10 before 10.8.5
- CrushFTP 11 before 11.3.4_23
Fixed in:
- CrushFTP 10.8.5
- CrushFTP 11.3.4_23
- CrushFTP 11.3.5
Patch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Built from source
# Admin web interface > About > Update to 11.3.5+ or 10.8.5+
# then use About > validate hashes to confirm no injected codeGeneral update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
If you cannot patch yet
- Limit the IP addresses allowed to use administration, and allow-list IPs that can connect (vendor).
- Enterprise users: put a DMZ CrushFTP instance in front; such setups were not affected.
- Enable automatic updates in Preferences > Updates.
Look for signs of exploitation
- The default user has admin access.
- Long random user IDs you do not recognise (e.g. 7a0d26089ac528941bf8cb998d97f408m) or other recently created admin users.
- End-user WebInterface buttons disappeared and a regular user now has an Admin button.
- Attackers fake the displayed version: use the validate hashes function on the About tab to compare MD5 hashes.
- If compromised: restore the default user from CrushFTP/backup/users/MainUsers/ (from before the attack) and review upload/download reports.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 ; https://nvd.nist.gov/vuln/detail/CVE-2025-54309
Related vulnerabilities
Sources
- CVE record CVE-2025-54309
- NVD CVE-2025-54309
- CISA KEV entry CVE-2025-54309
- CrushFTP: CompromiseJuly2025
- CrushFTP Update page
- Rapid7: CrushFTP zero-day exploited in the wild
- https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/
- https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability
- CISA Known Exploited Vulnerabilities catalog
Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.