{"id":"CVE-2025-54309","kind":"vulnerability","aliases":["CVE-2025-54309"],"related":[],"title":"CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation…","description":"CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"CrushFTP, a file transfer server, has a flaw where its alternate channel does not validate AS2 properly when the DMZ proxy feature is not in use. A remote attacker can gain admin access over HTTPS.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-07-22T00:00:00+00:00","products":[{"name":"CrushFTP CrushFTP","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"crushftp","fixed":["10.8.5"],"affected":">= 10.0.0, < 10.8.5","ecosystem":"vendor"},{"name":"crushftp","fixed":["11.3.4_23"],"affected":">= 11.0.0, < 11.3.4_23","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["crushftp","exploited","file-transfer","other","self-hosted"],"not_affected_if":["dmz-proxy-enabled"],"how_to_check":null,"fix":"Apply the vendor mitigations per CISA guidance; discontinue use if mitigations are unavailable. Specific fixed version: unknown","status":"open","published_at":"2025-07-18T19:15:25+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:46:40+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T20:46:40Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations per CISA guidance; discontinue use if mitigations are unavailable. Specific fixed version: unknown","reach":"internet","summary":"CrushFTP, a file transfer server, has a flaw where its alternate channel does not validate AS2 properly when the DMZ proxy feature is not in use. A remote attacker can gain admin access over HTTPS.","category":"other","who_cares":["crushftp","self-hosted","file-transfer"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote attacker gains CrushFTP admin access and can control the file transfer server.","analyst_note":"Find the CrushFTP vendor advisory and the fixed version number, plus the exact mitigation steps and config setting to check; sources give none.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["dmz-proxy-enabled"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000432,"input_tokens":2562,"output_tokens":351,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':116C '-2025':22A,25A '-54309':23A,26A '10':2A '10.8.5':4A '11':6A '11.3.4':8A '22':115C '23':9A 'access':72B,101C 'action':106C 'admin':71B,100C 'allow':95C 'altern':50B,79C 'appli':107C 'applic':113C 'as2':19A,55B,91C 'attack':68B,97C 'bod':114C 'channel':51B,80C 'cisa':104C 'cloud':119C 'consequ':94C 'contain':76C 'crushftp':1A,27A,28A,29A,30A,31B,40B,75C 'cve':21A,24A 'discontinu':122C 'dmz':12A,59B,84C 'exploit':32B 'featur':14A,61B,86C 'file':34B,42B 'file-transf':33B 'flaw':47B 'follow':112C 'gain':70B 'guidanc':117C 'host':39B 'https':74B,103C 'instruct':111C 'mishandl':18A,90C 'mitig':108C,128C 'obtain':99C 'per':109C 'product':126C 'proper':56B 'proxi':13A,60B,85C 'remot':67B,96C 'requir':105C 'self':38B 'self-host':37B 'server':44B 'servic':120C 'transfer':35B,43B 'unavail':130C 'unprotect':78C 'use':17A,65B,89C,123C 'valid':20A,54B,92C 'vendor':110C 'via':102C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-07-18T19:15:25+00:00","kev":{"dateAdded":"2025-07-22","dueDate":"2025-08-12","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-54309","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54309","severity":null,"published_at":"2025-07-22T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-54309","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54309","severity":null,"published_at":"2025-07-18T19:15:25+00:00","modified_at":"2026-06-17T09:39:49+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}