CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2025-07-18
CrushFTP AS2 Validation Authentication Bypass Vulnerability (CVE-2025-54309) Security Advisory
[Affected Scope] CrushFTP 10 before 10.8.5 and CrushFTP 11 before 11.3.4_23, specifically when the DMZ proxy feature is not utilized.
[Impact] Unauthenticated remote attackers can bypass AS2 validation via HTTPS to obtain full administrative access, which has been actively exploited in the wild.
[Mitigation] Immediately upgrade to CrushFTP 10.8.5, 11.3.4_23, or later, or restrict direct HTTPS access and enable the DMZ proxy feature.