CVE-2025-54309 CrushFTP Unprotected Alternate Channel
Remote attackers can gain admin access via HTTPS when DMZ proxy is disabled, requiring immediate upgrade to secure the FTP server.
- Exploited in the wild
- Since 22 Jul 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-54309?
CVE-2025-54309 is a critical authentication bypass vulnerability in CrushFTP, published on 18 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
Weakness: CWE-420
Which versions are affected by CVE-2025-54309?
It affects 1 product.
Products include Crushftp Crushftp.
How do I fix CVE-2025-54309?
No fix has been published for CVE-2025-54309 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 12 Aug 2025.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-54309 being exploited?
Yes. Attackers have exploited CVE-2025-54309 in the wild since at least 22 Jul 2025.
Public exploit code: 7 proofs of concept on GitHub.
Other vulnerabilities in CrushFTP
Sources
Also known as GHSA-rh5q-v9ww-rqgm.