CVE-2025-54309

UNKNOWNKnown Exploited

CISA Known Exploited Vulnerability

https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 ; https://nvd.nist.gov/vuln/detail/CVE-2025-54309

Remediation deadline: August 12, 2025

Description

CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.

Timeline

Published:July 22nd, 2025 12:00 AM

Last modified:July 22nd, 2025 12:00 AM

Added to KEV:July 22nd, 2025

CVSS Scoring

No CVSS v3 score available

Affected Software

From NVD CPE configuration data

Vendors

CrushFTP

Products

CrushFTP

Weaknesses (CWE)

CWE-420

References & Reports

Advisories, patches, and third-party reports

No references available.

Source: CISA KEV + NVD · Data may lag official sources by up to one minute