Read the docs
TI-2025-34136 Aliases CVE-2025-54309GHSA-rh5q-v9ww-rqgm

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not…

Priority CRITICAL 100Exploited in the wildCWE-420Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

Why it matters now

Exploitation Active In CISA KEV since 2025-07-22CISA due date 2025-08-12
EPSS 0.93473 99th percentileScored 2026-11-07
Fix Fixed CrushFTP (CrushFTP): 10.8.5, 11.3.4_23

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CrushFTPCrushFTP10 to before 10.8.5; 11 to before 11.3.4_2310.8.5, 11.3.4_23Patch availableCNA
  • CrushFTP VendorCrushFTP Affected 10 to before 10.8.5; 11 to before 11.3.4_23 Fixed in 10.8.5, 11.3.4_23 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*10.0.0 to before 10.8.5; 11.0.0 to before 11.3.4_23VulnerableCrushFTP
  • cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:* Versions 10.0.0 to before 10.8.5; 11.0.0 to before 11.3.4_23 Vulnerable ·CrushFTP

Remediation

  • Fix · CNA CrushFTP (CrushFTP) Fixed in 10.8.5, 11.3.4_23

Timeline

  1. 2025-07-22 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2025-54309
  3. 2026-10-03 Alias added: GHSA-rh5q-v9ww-rqgm

References

Advisory 3

Other 2

  • TI-2025-22407 Authentication bypass in CrushFTP KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-03769 Unauthenticated arbitrary file read and remote code execution in CrushFTP KEVCVSS 3.1CRITICAL 10.0
  • TI-2023-23122 CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of… CVSS 3.1CRITICAL 9.8
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2025-39307 Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. CVSS 3.1MEDIUM 6.1
  • TI-2025-23205 Path traversal in CrushFTP CVSS 3.1MEDIUM 5.0
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences