Latest CrushFTP vulnerability: CVE-2025-54309 #
CrushFTP disclosed a vulnerability in certain versions of their file transfer product, which fails to protect the alternate channel AS2 (Applicability Statement 2) data transfer protocol via HTTP(S) when a DMZ proxy instance is not used. The mishandling of AS2 validation allows a remote adversary to bypass the intended security measures, and obtain administrative access via HTTP(S). This vulnerability has been designated CVE-2025-54309 and has been rated critical with a CVSS score of 9.0. There is evidence that this vulnerability is being actively exploited in the wild.
The following versions are affected:
- CrushFTP versions 10.x prior to 10.8.5
- CrushFTP versions 11.x prior to 11.3.4_23
What is the impact? #
Successful exploitation of this vulnerability would allow an adversary to execute administrative functions within the CrushFTP service without authentication, potentially leading to complete system compromise and data integrity issues.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible.
- CrushFTP release 10.x upgrade to version 10.8.5 or later
- CrushFTP release 11.x upgrade to version 11.3.4_23 or later
How to find potentially vulnerable systems with runZero #
From the Software Inventory, use the following query to locate systems running potentially vulnerable software:
vendor:=CrushFTP AND product:CrushFTPApril 2025: (CVE-2025-31161) #
CrushFTP disclosed that a vulnerability in their file transfer product allows an unauthenticated remote attacker to bypass authentication on some HTTPS interfaces. Since the original disclosure, a CVE was assigned, CVE-2025-2825, and later, CVE-2025-31161. This vulnerability is being exploited in the wild.
What is the impact? #
Successfully exploiting this vulnerability would allow an attacker to execute administrative functions within the CrushFTP service without authentication. Versions of CrushFTP 11 prior to 11.3.1 and CrushFTP 10 prior to 10.8.4 are vulnerable.
Are updates or workarounds available? #
CrushFTP has released versions 11.3.1 and 10.8.4 to address this issue. The vendor has also indicated that enabling the DMZ setting in the CrushFTP configuration will mitigate this issue. CrushFTP administrators are advised to update at their earliest opportunity.
Previous CrushFTP vulnerability (April 2024) #
CrushFTP disclosed that a vulnerability in their file transfer product allows an unauthenticated attacker to access the host's file system. No CVE has yet to be assigned for this issue and CrowdStrike has indicated that this issue is being actively exploited in the wild. Additional details can be found in this article by Sergiu Gatlan at BleepingComputer.
What is the impact? #
This issue affects all CrushFTP versions prior to 10.7.1 and CrushFTP 11 releases prior to patch 11.1.0. An unauthenticated attacker can abuse this issue to read files from the host's file system.
Are updates or workarounds available? #
CrushFTP has released versions 10.7.1 and 11.1.0 to address this issue.
