---
id: "CVE-2025-54309"
kind: "vulnerability"
aliases: ["CVE-2025-54309"]
title: "CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "CrushFTP CrushFTP", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "crushftp", "fixed": ["10.8.5"], "affected": ">= 10.0.0, < 10.8.5", "ecosystem": "vendor"}, {"name": "crushftp", "fixed": ["11.3.4_23"], "affected": ">= 11.0.0, < 11.3.4_23", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["crushftp", "exploited", "file-transfer", "other", "self-hosted"]
not_affected_if: ["dmz-proxy-enabled"]
published_at: "2025-07-18T19:15:25+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54309", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54309", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation…

CrushFTP, a file transfer server, has a flaw where its alternate channel does not validate AS2 properly when the DMZ proxy feature is not in use. A remote attacker can gain admin access over HTTPS.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:CrushFTP CrushFTP affected ? fixed ?
- vendor:crushftp affected >= 10.0.0, < 10.8.5 fixed 10.8.5
- vendor:crushftp affected >= 11.0.0, < 11.3.4_23 fixed 11.3.4_23

## Fix

Apply the vendor mitigations per CISA guidance; discontinue use if mitigations are unavailable. Specific fixed version: unknown

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54309
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-54309

## From the sources

CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_