Known Exploited Vulnerabilities July 22, 2025 · CISA KEV Catalog

CVE-2025-54309: CrushFTP Unprotected Alternate Channel Vulnerability

Summary: CVE-2025-54309 is an unprotected alternate channel vulnerability in CrushFTP that mishandles AS2 validation when the DMZ proxy feature is not used, allowing remote attackers to obtain admin access via HTTPS. CISA has set a remediation due date of 2025-08-12, and known ransomware campaign use of this flaw is listed as unknown.

Why it matters: Remote attackers can reach admin access over HTTPS on any CrushFTP instance running without the DMZ proxy, and CISA's 2025-08-12 deadline leaves a fixed window to close it before the unknown ransomware status becomes a known one.

Read the original at CISA KEV Catalog ↗

Topics

Vulnerabilities & Patching

Mentions

CVE-2025-54309CrushFTP

Related

CVE-2025-31161: CrushFTP Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Apr 07, 2025

CVE-2024-4040: CrushFTP VFS Sandbox Escape Vulnerability Known Exploited Vulnerabilities · Apr 24, 2024

Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026