CVE-2025-54309: CrushFTP AS2 validation flaw grants remote admin access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote admin takeover with active in-the-wild exploitation, KEV listing and a 9.8 CVSS score.

What it is

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23 mishandle AS2 validation when the DMZ proxy feature is not in use, letting remote attackers obtain admin access over HTTPS. The flaw is rated CVSS 9.8 and was exploited in the wild in July 2025, so unpatched internet-facing servers are at immediate risk.

Impact

An unauthenticated remote attacker gains administrative control of the CrushFTP server, exposing file transfers, stored credentials and connected systems. Admin access can be used to alter configuration, read or exfiltrate data, and pivot further into the network.

Attack surface

Reachable over the network via HTTPS with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The condition is that the DMZ proxy feature is not used; deployments relying on that proxy are outside the described path.

Exploitation

Listed in CISA KEV with a 2025-08-12 remediation due date and reported as exploited in the wild in July 2025. EPSS is 0.94709 (99.85th percentile), indicating very high predicted exploitation activity.

What to do

• Upgrade to CrushFTP 10.8.5 or later, or 11.3.4_23 or later, as the vendor directs.
• If patching is not immediately possible, follow the vendor's CompromiseJuly2025 advisory mitigations or discontinue exposure of the service.
• Restrict HTTPS access to the CrushFTP interface to trusted networks and remove direct internet exposure where feasible.
• After patching, rotate administrative credentials and review server configuration for unauthorized changes.
• Track CISA KEV remediation requirements and BOD 22-01 guidance for any cloud-hosted instances.

Detection

• Review CrushFTP logs for unexpected administrative logins or configuration changes, especially from unfamiliar source IPs.
• Hunt for anomalous HTTPS requests to the CrushFTP AS2 endpoints that precede admin session creation.
• Monitor for new or modified admin accounts and for outbound connections from the CrushFTP host to unknown destinations.
• Check exposed CrushFTP versions against the fixed releases to find unpatched instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.