CVE-2025-54309

CriticalKnown Exploited

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently…

mitre·CWE-420·Published 2025-07-18

CVSS

9.8

EPSS

0.92

KEV

Yes

Exploits

cve.orgen

230 chars

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

NVDen

230 chars

NVDes

293 chars

CrushFTP 10 anterior a 10.8.5 y 11 anterior a 11.3.4_23, cuando no se utiliza la función de proxy DMZ, maneja incorrectamente la validación AS2 y, en consecuencia, permite a atacantes remotos obtener acceso de administrador a través de HTTPS, como se explotó en la naturaleza en julio de 2025.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	NVD	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1	Primary	cve.org	9.0	—	—	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
3.1	Primary	cve.org	9.0	—	—	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
3.1	Secondary	NVD	9.0	2.2	6.0	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H