# CVE-2025-54309: CrushFTP - Authentication Bypass

> Live exploitation tracking for CVE-2025-54309 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-54309

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.0
- **Public exploit available:** Yes
- **Affected products:** CrushFTP
- **Weaknesses:** CWE-420 (Unprotected Alternate Channel)
- **Tags:** file_sharing

## Description

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

## CrowdSec analysis

[CVE-2025-54309](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-54309) is a critical vulnerability in CrushFTP versions 10 before 10.8.5 and 11 before 11.3.4_23 that improperly handles AS2 validation when the DMZ proxy feature is disabled. This flaw allows remote attackers to gain administrative access over HTTPS, and has been actively exploited in the wild as of July 2025. Attackers leveraging this vulnerability could fully compromise affected servers, leading to unauthorized data access and control.

CrowdSec has been tracking this vulnerability and its exploits since 13th of August 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2025-54309 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2025-54309. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit unauthenticated endpoints such as `/WebInterface/function/`, `/WebInterface/login/`, and `/WebInterface/json/` on CrushFTP servers to execute arbitrary commands or upload files, often by sending specially crafted XML, JSON, or form data payloads. These exploitation attempts typically target the `system.exec` or `file.write` methods to achieve remote code execution or unauthorized file manipulation.

## Timeline

- 2025-07-18: CVE Published. CVE-2025-54309 is published to NVD.
- 2025-07-22: CISA KEV. CVE-2025-54309 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2025-08-12: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2025-08-13: Rule Released. CrowdSec releases a rule to detect CVE-2025-54309 exploitation attempts against the CrowdSec Network.
- 2025-08-25: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-54309 for the first time.

## References

- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025
- https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/
- https://github.com/rix4uni/cvemapping/blob/main/2025/CVE-2025-54309/exploit.py

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-54309) follows observed exploitation activity for CVE-2025-54309. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.