{"id":"CVE-2025-54309","published":"2025-07-18T19:15:25Z","modified":"2026-06-17T09:39:49Z","title":"CrushFTP Unprotected Alternate Channel Vulnerability","vendor":"CrushFTP","product":"CrushFTP","tier":"core","eol":null,"description":{"text":"CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.","provenance":"source","from":"NVD"},"summary":{"text":"CrushFTP's AS2 validation flaw affects CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23 when the DMZ proxy feature is not in use. An attacker with network access to the HTTPS interface can gain administrative access without authentication or user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:44Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.93473,"percentile":0.99839,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2025-07-22","dueDate":"2025-08-12","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 ; https://nvd.nist.gov/vuln/detail/CVE-2025-54309 ","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-07-18","exploitedFirstSeen":"2025-07-18","ransomware":false,"evidence":[{"url":"https://arcticwolf.com/resources/blog/cve-2025-54309-critical-zero-day-vulnerability-in-crushftp-exploited/","date":"2025-07-18"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54309","date":"2025-07-18"},{"url":"https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025","date":"2025-07-18"},{"url":"https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/","date":"2025-07-18"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-07-22"},{"url":"https://8813571.fs1.hubspotusercontent-na1.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250812.pdf","date":"2025-08-12"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-54309","date":"2025-08-25"},{"url":"https://labs.watchtowr.com/the-one-where-we-just-steal-the-vulnerabilities-crushftp-cve-2025-54309/","date":"2025-08-27"},{"url":"https://projectdiscovery.io/blog/from-detection-to-validation-fixing-broken-vulnerability-workflows","date":"2025-10-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-10-10&host_type=src&vulnerability=cve-2025-54309","date":"2025-10-10"}],"evidenceTotal":83,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-420","name":"Unprotected Alternate Channel"}],"references":[{"url":"https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/","tags":["Press/Media Coverage"]},{"url":"https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025","tags":["Vendor Advisory"]},{"url":"https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/","tags":["Press/Media Coverage"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability","tags":["Third Party Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"exploitation_technique","evidence":[],"comment":"Improper validation of AS2 messages in CrushFTP without DMZ proxy enabled were reported to be exploited to bypass authentication and gain administrative access over HTTPS, leading to system compromise, data exfiltration, and lateral movement.","confidence":"high"},{"id":"T1567","name":"Exfiltration Over Web Service","tactics":["exfiltration"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"Improper validation of AS2 messages in CrushFTP without DMZ proxy enabled were reported to be exploited to bypass authentication and gain administrative access over HTTPS, leading to system compromise, data exfiltration, and lateral movement.","confidence":"high"},{"id":"T1021","name":"Remote Services","tactics":["lateral-movement"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"Improper validation of AS2 messages in CrushFTP without DMZ proxy enabled were reported to be exploited to bypass authentication and gain administrative access over HTTPS, leading to system compromise, data exfiltration, and lateral movement.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-21909","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-21909","exploited":true,"exploitedSince":"2025-07-22","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":6,"skipped":1,"earliest":"2025-08-25","earliestUrl":"https://github.com/watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309","repos":[{"name":"watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309","url":"https://github.com/watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309","stars":28,"created":"2025-08-25"},{"name":"foregenix/CVE-2025-54309","url":"https://github.com/foregenix/CVE-2025-54309","stars":2,"created":"2025-09-03"},{"name":"whisperer1290/CVE-2025-54309__Enhanced_exploit","url":"https://github.com/whisperer1290/CVE-2025-54309__Enhanced_exploit","stars":1,"created":"2025-09-06"},{"name":"0xLittleSpidy/CVE-2025-54309","url":"https://github.com/0xLittleSpidy/CVE-2025-54309","stars":1,"created":"2026-01-27"},{"name":"blueisbeautiful/CVE-2025-54309","url":"https://github.com/blueisbeautiful/CVE-2025-54309","stars":0,"created":"2025-08-29"}]},"first":{"date":"2025-08-25","source":"PoC-in-GitHub","url":"https://github.com/watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309"},"provenance":"source"},"detections":{"cveRules":[{"title":"Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)","id":"0fdc7c7f-c690-4217-9ae3-31f5156eed72","level":"high","status":"experimental","path":"rules-emerging-threats/2025/Exploits/CVE-2025-54309/proc_creation_win_exploit_cve_2025_54309.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-54309/proc_creation_win_exploit_cve_2025_54309.yml","techniques":["T1059.001","T1059.003","T1068","T1190"]}]},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"source"},{"stage":"primary","techniques":["T1567"],"provenance":"source"},{"stage":"secondary","techniques":["T1021"],"provenance":"source"}],"timeline":[{"date":"2025-07-18","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54309","provenance":"source"},{"date":"2025-07-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://arcticwolf.com/resources/blog/cve-2025-54309-critical-zero-day-vulnerability-in-crushftp-exploited/","provenance":"source"},{"date":"2025-07-22","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-07-22","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-21909","provenance":"source"},{"date":"2025-08-25","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309","provenance":"source"}],"speed":{"daysToPublicExploit":38,"firstExploitFrom":"PoC-in-GitHub","daysToKev":4},"priority":{"score":66.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 471 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9984"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"6 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}