CVE Watch—

CVE-2025-54309

CrushFTP Unprotected Alternate Channel Vulnerability

CVSS

—

Sem CVSS

EPSS

93.5%

p100

KEV

SIM

22 de jul. de 2025

Exploit Today

0-100

Publicado: — · Última mod.: —

EPSS · 30d

93.5%EPSS · 30 dias95.1%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

CrushFTP / CrushFTP

Vulnerabilidade

CrushFTP Unprotected Alternate Channel Vulnerability

Adicionado ao KEV

22 de jul. de 2025

Corrigir até

12 de ago. de 2025

Uso conhecido em ransomware

Não

Descrição resumida

CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.

Ação necessária

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 ; https://nvd.nist.gov/vuln/detail/CVE-2025-54309

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2025-31161—

100.0%

KEV—80CrushFTP Authentication Bypass Vulnerability—CVE-2024-4040—

99.9%

KEV—80CrushFTP VFS Sandbox Escape Vulnerability—