CVE-2025-54309: CrushFTP AS2 Validation Bypass to Admin Takeover (KEV, Exploited)

CVE-2025-54309 is an unprotected-alternate-channel flaw (CWE-420) in CrushFTP's AS2 validation: on servers that are not using CrushFTP's DMZ proxy feature, a remote attacker can reach the admin interface over HTTPS and obtain administrative access without valid credentials, and CrushFTP has confirmed this was exploited as a zero-day starting around 2025-07-18 before a fix was available.

CVE-2025-54309 is an unprotected alternate channel vulnerability (CWE-420) in CrushFTP, an enterprise file-transfer server. Per NVD: "CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025" (NVD).

NVD's own analysis gives CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, full impact to confidentiality, integrity and availability. A separate CNA (MITRE) submission scores it lower, CVSS v3.1 9.0, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, reflecting a higher attack-complexity view of the same flaw; this page uses NVD's own Primary score (NVD).

CrushFTP's own incident advisory states the zero-day was discovered in the wild on "July 18th, 9AM CST," and that "hackers apparently reverse engineered our code and found some bug which we had already fixed" — i.e. attackers exploited a related, not-fully-closed aspect of an earlier AS2-area patch before CrushFTP shipped the complete fix. The advisory recommends restoring the default admin user from a pre-July-16 backup (located under CrushFTP folder/backup/users/MainUsers/default) in case it was tampered with, and recommends ongoing mitigations: keep CrushFTP patched, enable automatic updates, restrict admin access by IP allowlist, and avoid exposing the admin interface directly to the internet (CrushFTP Advisory — July 2025 Compromise).

CISA added CVE-2025-54309 to the Known Exploited Vulnerabilities (KEV) catalog on 2025-07-22, with a required-action due date of 2025-08-12; the catalog lists known ransomware-campaign use as "Unknown" as of this check (catalog version 2026.10.29, 1764 entries, confirmed live this run by matching the exact CVE ID string in the raw KEV JSON feed) (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.93473 (99.838th percentile) — among the highest EPSS scores in this library, consistent with an internet-facing file-transfer admin-takeover bug that was actively exploited pre-patch (FIRST EPSS).

Any CrushFTP instance on 10.x before 10.8.5 or 11.x before 11.3.4_23 that is not behind the DMZ proxy should be upgraded immediately, its default admin credentials rotated from a trusted pre-compromise backup, and its admin interface restricted to an IP allowlist rather than exposed openly.

• CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and allows remote attackers to obtain admin access via HTTPS; exploited in the wild in July 2025. — NVD
• NVD Primary CVSS v3.1 score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; a separate CNA (MITRE) Secondary score rates it 9.0 with higher attack complexity. — NVD
• Zero-day discovered in the wild on July 18, 2025; attackers reverse-engineered a partially-fixed AS2-area bug. Fixed in 10.8.5 and 11.3.4_23 (11.3.5 recommended); mitigation includes restoring the default admin user from a pre-July-16 backup and IP-restricting admin access. — CrushFTP Advisory — July 2025 Compromise
• Added to the CISA Known Exploited Vulnerabilities catalog on 2025-07-22, due date 2025-08-12, known ransomware use listed as Unknown. — CISA KEV
• EPSS score is 0.93473 (99.838th percentile) as of 2026-10-29. — FIRST EPSS