CVE-2025-54309: listed in the CISA KEV catalog CVE-2025-54309 · CVSS 9.0 CRITICAL · EPSS 93% · KEV 2025-07-22 · patch available
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
Is CVE-2025-54309 exploited? Listed in the CISA KEV catalog on 2025-07-22. Federal remediation due 2025-08-12. Past that date by 444 days. EPSS puts exploitation in the next 30 days at 93%. Public exploit code: none found in monitored sources. Which products and versions are affected? CrushFTP · CrushFTP · >= 10, < 10.8.5, >= 11, < 11.3.4_23 Is there a patch? Yes. Update to one of these or later:
CrushFTP 10 10.8.5 CrushFTP 11 11.3.4_23
From CrushFTP's CVE record · CrushFTP advisory
What PlainSec published about CVE-2025-54309 Primary sources KEV and EPSS are re-checked daily. Record last updated 2026-10-19.
CVE-2025-54309: listed in the CISA KEV catalog CVE-2025-54309 · CVSS 9.0 CRITICAL · EPSS 93% · KEV 2025-07-22 · patch available
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
Is CVE-2025-54309 exploited? Listed in the CISA KEV catalog on 2025-07-22. Federal remediation due 2025-08-12. Past that date by 444 days. EPSS puts exploitation in the next 30 days at 93%. Public exploit code: none found in monitored sources. Which products and versions are affected? CrushFTP · CrushFTP · >= 10, < 10.8.5, >= 11, < 11.3.4_23 Is there a patch? Yes. Update to one of these or later:
CrushFTP 10 10.8.5 CrushFTP 11 11.3.4_23
From CrushFTP's CVE record · CrushFTP advisory
What PlainSec published about CVE-2025-54309 Primary sources KEV and EPSS are re-checked daily. Record last updated 2026-10-19.