CVE Watch—

CVE-2025-54309

CrushFTP Unprotected Alternate Channel Vulnerability

CVSS

—

No CVSS

EPSS

95.1%

p100

KEV

YES

Jul 22, 2025

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

94.7%EPSS · 30 days95.1%

2026-09-162026-10-14

KEV catalog record

Product

CrushFTP / CrushFTP

Vulnerability

CrushFTP Unprotected Alternate Channel Vulnerability

Added to KEV

Jul 22, 2025

Remediate by

Aug 12, 2025

Known ransomware use

Summary description

CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 ; https://nvd.nist.gov/vuln/detail/CVE-2025-54309

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-31161—

100.0%

KEV—80CrushFTP Authentication Bypass Vulnerability—CVE-2024-4040—

99.9%

KEV—80CrushFTP VFS Sandbox Escape Vulnerability—