CVE-2025-54309

🗓️ 18 Jul 2025 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 24 Media mentions👁 211 Views🌐 WEB

CrushFTP vulnerability allows remote admin access due to AS2 validation mishandling in certain versions

Reporter	Title	Published	Views	Family All 35
GithubExploit	Exploit for Unprotected Alternate Channel in Crushftp	27 Jan 202612:10	–	githubexploit
GithubExploit	Exploit for Unprotected Alternate Channel in Crushftp	26 Jul 202514:51	–	githubexploit
GithubExploit	Exploit for Unprotected Alternate Channel in Crushftp	13 Sep 202507:42	–	githubexploit
GithubExploit	Exploit for Unprotected Alternate Channel in Crushftp	6 Sep 202521:43	–	githubexploit
GithubExploit	Exploit for Unprotected Alternate Channel in Crushftp	25 Aug 202503:07	–	githubexploit
GithubExploit	Exploit for Unprotected Alternate Channel in Crushftp	6 Dec 202510:12	–	githubexploit
GithubExploit	Exploit for Unprotected Alternate Channel in Crushftp	29 Aug 202503:05	–	githubexploit
BDU FSTEC	The vulnerability of the web interface of the cross-platform FTP server CrushFTP allows a hacker to execute arbitrary code with elevated privileges.	21 Jul 202500:00	–	bdu_fstec
Circl	CVE-2025-54309	18 Jul 202519:40	–	circl
CISA KEV Catalog	CrushFTP Unprotected Alternate Channel Vulnerability	22 Jul 202500:00	–	cisa_kev

NVD

Vulners

CNA

Node

crushftp crushftpRange10.0.0–10.8.5

crushftp crushftpRange11.0.0–11.3.4_23

[
  {
    "defaultStatus": "unaffected",
    "product": "CrushFTP",
    "vendor": "CrushFTP",
    "versions": [
      {
        "lessThan": "10.8.5",
        "status": "affected",
        "version": "10",
        "versionType": "custom"
      },
      {
        "lessThan": "11.3.4_23",
        "status": "affected",
        "version": "11",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
vicarius	www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability
vicarius	www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability
rapid7	www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/
crushftp	www.crushftp.com/crush11wiki/Wiki.jsp
bleepingcomputer	www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
command	request body	WebInterface/function/	Authentication bypass via AS2 header allows unauthorized creation of admin users through setUserItem (e.g., command=setUserItem with data_action=new)	CWE-420
username	request body	WebInterface/function/	Authentication bypass via AS2 header allows unauthorized creation of admin users through setUserItem (e.g., command=setUserItem with data_action=new)	CWE-420
user	request body	WebInterface/function/	Authentication bypass via AS2 header allows unauthorized creation of admin users through setUserItem (e.g., command=setUserItem with data_action=new)	CWE-420
data_action	request body	WebInterface/function/	Authentication bypass via AS2 header allows unauthorized creation of admin users through setUserItem (e.g., command=setUserItem with data_action=new)	CWE-420
serverGroup	request body	WebInterface/function/	Authentication bypass via AS2 header allows unauthorized creation of admin users through setUserItem (e.g., command=setUserItem with data_action=new)	CWE-420
enabled	request body	WebInterface/function/	Authentication bypass via AS2 header allows unauthorized creation of admin users through setUserItem (e.g., command=setUserItem with data_action=new)	CWE-420
password	request body	WebInterface/function/	Authentication bypass via AS2 header allows unauthorized creation of admin users through setUserItem (e.g., command=setUserItem with data_action=new)	CWE-420
user	request body	WebInterface/function/	Authentication bypass via AS2 header allows unauthorized creation of admin users through setUserItem (e.g., command=setUserItem with data_action=new)	CWE-420
enabled	request body	WebInterface/function/	Authentication bypass via AS2 header allows unauthorized creation of admin users through setUserItem (e.g., command=setUserItem with data_action=new)	CWE-420
password	request body	WebInterface/function/	Authentication bypass via AS2 header allows unauthorized creation of admin users through setUserItem (e.g., command=setUserItem with data_action=new)	CWE-420

17 Jun 2026 09:39Current

7.2High risk

Vulners AI Score7.2

CVSS 3.19 - 9.8

EPSS0.94709

SSVC

crushftp vulnerability as2 validation admin access dmz proxy remote attackers