CrushFTP Zero-Day Vulnerability CVE-2025-54309

THE THREAT

On July 18th, 2025, CrushFTP confirmed exploitation of a critical zero-day vulnerability, CVE-2025-54309.

CVE-2025-54309 (CVSS: 9.0) occurs due to mishandling of AS2 validation in CrushFTP instances with DMZ feature disabled, allowing remote attackers to gain administrator access via HTTPS. Successful exploitation of the vulnerability may result in theft of sensitive data leading to data extortion attacks. As of July 20th, 2025, the Shadowserver Foundation reported that 1,040 CrushFTP instances remain unpatched and are likely vulnerable to exploitation.

Given the large number of exposed, internet-facing vulnerable instances and ongoing exploitation of the CVE-2025-54309, organizations are strongly urged to apply the necessary patches immediately.

What we’re doing about it

• eSentire’s MDR for Log includes detections to identify anomalous user authentication activity in CrushFTP
• eSentire Managed Vulnerability Service (MVS) has plugins in place to identify vulnerable devices
• The eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches
• If exploitation is observed:
  • Restore the default user configuration from a backup dated before July 16th, 2025
  • Review upload/download logs for unusual activity
• CrushFTP recommends following the below steps for future mitigations:
  • Limit IP addresses for administrative access and whitelist ones that can connect to the CrushFTP server
  • Enable DMZ for the CrushFTP instances
  • Enable automatic updates

Additional information

CrushFTP stated they fixed a vulnerability related to AS2 in HTTP(S) that unintentionally addressed the now exploited critical CVE-2025-54309 vulnerability. CrushFTP believes the attackers reverse engineered their code to identify the vulnerability and exploit it in instances that had not been updated. Organizations running up-to-date versions of CrushFTP are not affected by the reported exploitation. The security advisory also mentioned that enterprise customers with DMZ enabled remain unaffected.

CrushFTP has issued guidance in their security advisory to help identify IoCs, with the most common sign being unauthorized modifications to the default user account. No other technical details related to CVE-2025-54309 are disclosed, and no Proof-of-Concept (PoC) exploit code is publicly available at the time of writing.

Due to the platform’s broad use across multiple industries, vulnerabilities in the application continue to be a prominent target for attackers. eSentire previously addressed a critical vulnerability in CrushFTP disclosed in April 2025. Other file transfer applications like Cleo Managed File Transfer (MFT) and MOVEit Transfer have been recurringly targeted by threat actors resulting in data theft and extortion attacks. Given the criticality of CVE-2025-54309, it is crucial that organizations promptly address vulnerability by applying the recommended patches.

Impacted Versions List:

• CrushFTP All version 10 below 10.8.5
• CrushFTP All version 11 below 11.3.4_23

References:

[1] https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-54309
[3] https://bsky.app/profile/shadowserver.bsky.social/post/3luhrfgevec24
[4] https://www.esentire.com/security-advisories/crushftp-authentication-bypass
[5] https://www.esentire.com/security-advisories/cleo-managed-file-transfer-zero-day
[6]https://www.esentire.com/security-advisories/moveit-authentication-bypass-vulnerability