Is CVE-2025-54309 actively exploited?

Yes. CVE-2025-54309 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2025-54309 be exploited remotely?

The attack vector of CVE-2025-54309 has not been classified yet.

What is the CVSS score of CVE-2025-54309?

CVE-2025-54309 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2025-54309

HIGHCISA KEVIN THE WILD

CVE-2025-54309

Published: July 22, 2025

EPSS:70.45%probability of exploitation in 30 daysPercentile:98.7th

Official Description

CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.

NVD Source

CISA KEV Advisory

CrushFTP Unprotected Alternate Channel Vulnerability

Added to KEV: 2025-07-22Federal patch deadline: 2025-08-12

Required Action (CISA)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Risk Analysis

CrushFTP contains an unprotected alternate channel vulnerability that, when the DMZ proxy is not used, allows remote attackers to gain admin access via HTTPS due to mishandling AS2 validation. With an EPSS score of 0.70447 and confirmed exploitation in CISA's KEV, this is an urgent vulnerability requiring immediate attention.

This vulnerability is actively exploited in the wild. It is remotely exploitable via HTTPS, allowing attackers to gain administrative access without requiring complex attack vectors.

Recommended Action

CrushFTP users should ensure the DMZ proxy feature is properly configured and utilized. Apply all available security patches for CrushFTP to address the AS2 validation flaw and prevent unauthorized admin access.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2025-54309 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2025-54309 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.

Exploit & PoC Resources

ACTIVE EXPLOITATIONConfirmed exploitation in the wild

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

News & Research Mentioning CVE-2025-54309

Bruteforce Scans for CrushFTP , (Tue, Mar 3rd)

SANS ISC· Mar 3, 2026

CrushFTP is a Java-based open source file transfer system. It is offered for multiple operating systems. If you run a CrushFTP instance, you may remember that the software has had some serious vulnerabilities: CVE-2024-4040 (the template-injection flaw that let unauthenticated attackers escape the VFS sandbox and achieve RCE), CVE-2025-31161 (the auth-bypass that handed over the crushadmin account on a silver platter), and the July 2025 zero-day CVE-2025-54309 that was actively exploited in the wild. [xlite_meta score:72 src:SANS ISC xlite_fp:b811a697d8e8ef962ac5b77c1269ff4e79f3e4f271302acd70950196d560ddf7]