Security advisories

CrushFTP Zero-Day Vulnerability CVE-2025-54309

July 21, 2025 | 2 MINS READ

Speak With A Security Expert Now

TALK TO AN EXPERT

THE THREAT

On July 18th, 2025, CrushFTP confirmed exploitation of a critical zero-day vulnerability, CVE-2025-54309.

CVE-2025-54309 (CVSS: 9.0) occurs due to mishandling of AS2 validation in CrushFTP instances with DMZ feature disabled, allowing remote attackers to gain administrator access via HTTPS. Successful exploitation of the vulnerability may result in theft of sensitive data leading to data extortion attacks. As of July 20th, 2025, the Shadowserver Foundation reported that 1,040 CrushFTP instances remain unpatched and are likely vulnerable to exploitation.

Given the large number of exposed, internet-facing vulnerable instances and ongoing exploitation of the CVE-2025-54309, organizations are strongly urged to apply the necessary patches immediately.

What we’re doing about it

What you should do about it

Additional information

CrushFTP stated they fixed a vulnerability related to AS2 in HTTP(S) that unintentionally addressed the now exploited critical CVE-2025-54309 vulnerability. CrushFTP believes the attackers reverse engineered their code to identify the vulnerability and exploit it in instances that had not been updated. Organizations running up-to-date versions of CrushFTP are not affected by the reported exploitation. The security advisory also mentioned that enterprise customers with DMZ enabled remain unaffected.

CrushFTP has issued guidance in their security advisory to help identify IoCs, with the most common sign being unauthorized modifications to the default user account. No other technical details related to CVE-2025-54309 are disclosed, and no Proof-of-Concept (PoC) exploit code is publicly available at the time of writing.

Due to the platform’s broad use across multiple industries, vulnerabilities in the application continue to be a prominent target for attackers. eSentire previously addressed a critical vulnerability in CrushFTP disclosed in April 2025. Other file transfer applications like Cleo Managed File Transfer (MFT) and MOVEit Transfer have been recurringly targeted by threat actors resulting in data theft and extortion attacks. Given the criticality of CVE-2025-54309, it is crucial that organizations promptly address vulnerability by applying the recommended patches.

Impacted Versions List:

References:

[1] https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-54309
[3] https://bsky.app/profile/shadowserver.bsky.social/post/3luhrfgevec24
[4] https://www.esentire.com/security-advisories/crushftp-authentication-bypass
[5] https://www.esentire.com/security-advisories/cleo-managed-file-transfer-zero-day
[6]https://www.esentire.com/security-advisories/moveit-authentication-bypass-vulnerability

View Most Recent Advisories