CVE-2025-54309 CrushFTP CrushFTP
CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.
- CVSS
- not scored
On CISA’s exploited list
CrushFTP Unprotected Alternate Channel Vulnerability
- Added
- 2025-07-22
- Federal patch deadline
- 2025-08-12
- Ransomware use
- not known