Info Security Magazine22 Jul 2025
New CrushFTP Critical Vulnerability Exploited in the Wild
CVE-2025-54309 could allow remote attackers to obtain admin access via HTTPS
Actively exploited vulnerability
CVE-2025-54309: CrushFTP Unprotected Alternate Channel Vulnerability
CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.
CISA KEV source
22 Jul 2025 added
12 Aug 2025 remediation due
Affected product
CrushFTP ยท CrushFTP
Known ransomware use: Unknown
Required action
Follow the source advisory and validate exposure in your environment.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Related Yasna coverage
Recent reporting that mentions CVE-2025-54309.
The Hacker News20 Jul 2025
Hackers Exploit Critical CrushFTP Flaw to Gain Admin Access on Unpatched Servers
A newly disclosed critical security flaw in CrushFTP has come under active exploitation in the wild. Assigned the CVE identifier CVE-2025-54309, the vulnerability carries a CVSS score of 9.0
Bleeping Computer19 Jul 2025
New CrushFTP zero-day exploited in attacks to hijack servers
CrushFTP is warning that threat actors are actively exploiting a zero-day vulnerability tracked as CVE-2025-54309, which allows attackers to gain administrative access via the web interface on vulnerable servers. [...]
Bleeping Computer19 Jul 2025
CrushFTP zero-day exploited in attacks to gain admin access on servers
CrushFTP is warning that threat actors are actively exploiting a zero-day vulnerability tracked as CVE-2025-54309, which allows attackers to gain administrative access via the web interface on vulnerable servers. [...]