DaystoPatch

CrushFTPExploited incident

CrushFTP unauthenticated admin access via HTTP(S) (AS2 validation flaw, July 2025)

CVE-2025-54309Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 22 Jul 2025

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    CrushFTP wiki: CompromiseJuly2025 (Wayback snapshot 2025-07-18 16:34 UTC, page revision 6)CuratedQuote verified

    July 18th there is a 0-day exploit in the wild.

    Earliest capture shows 'This page (revision-6) was last changed on 18-Jul-2025 12:30 by Ben Spink' (no time zone). The current page says 'July 18th, 9AM CST there is a 0-day exploit seen in the wild.' 'CST' in July is ambiguous (CST UTC-6 vs CDT UTC-5), so day precision.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:939d4f1dabc97bfa…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    CVE.org record CVE-2025-54309ClaimedQuote verified18 Jul 2025, 00:00 UTC

    CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:e7f9b122ae1f4c59…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CrushFTP advisory CVE-2025-54309ClaimedQuote verified18 Jul 2025

    July 18th, 2025 - Unauthenticated HTTP(S) access using kown usernames(CVE: CVE-2025-54309) See more info here: CompromiseJuly2025

    The vendor's own disclosure.

    Source
    CrushFTP advisory CVE-2025-54309 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:55f359d079e35228…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet18 Jul 2025, 19:40 UTC

    CVE-2025-54309

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet19 Jul 2025, 09:39 UTC

    CVE Alert: CVE-2025-54309 - https://www. redpacketsecurity.com/cve_aler t_cve-2025-54309/ # OSINT # ThreatIntel # CyberSecurity # cve_2025_54309

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-54309)ClaimedQuote verified22 Jul 2025

    CrushFTP Unprotected Alternate Channel Vulnerability

    Added to CISA's KEV catalog on 2025-07-22.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet27 Aug 2025, 18:56 UTC

    https://labs.watchtowr.com/the-one-where-we-just-steal-the-vulnerabilities-crushftp-cve-2025-54309/

    Earliest third-party post we hold.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    CrushFTP advisory CVE-2025-54309ClaimedQuote verified

    July 18th, 2025 - Unauthenticated HTTP(S) access using kown usernames(CVE: CVE-2025-54309) See more info here: CompromiseJuly2025

    Source
    CrushFTP advisory CVE-2025-54309 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:55f359d079e35228…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    CrushFTP wiki: CompromiseJuly2025 (Wayback snapshot 2025-07-18)CuratedQuote verified18 Jul 2025

    This page (revision-6) was last changed on 18-Jul-2025 12:30 by Ben Spink

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:939d4f1dabc97bfa…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    CrushFTP wiki: CompromiseJuly2025 (Wayback snapshot 2025-07-18)CuratedQuote verified

    We believe this bug was in builds prior to July 1st time period roughly...we are not fully certain of the exact bug that is being exploited, but it appears the latest versions of CrushFTP already have the issue patched.

    Upper bound: fixed builds may have shipped earlier. fixed builds (10.8.5, 11.3.4_23) already existed when the page was posted on 2025-07-18; CrushFTP says the underlying bug was fixed around 2025-07-01 as a side effect of an AS2 change, but we found no dated release note for those builds. The real patch_first is earlier than recorded.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:939d4f1dabc97bfa…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    CrushFTP wiki: CompromiseJuly2025 (current revision)CuratedQuote verified

    All version 10 below 10.8.5. This means *ALL* 10.8.5 versions are SAFE!

    Both supported lines had fixed builds by the 2025-07-18 notice: v10 10.8.5 and v11 11.3.4_23 (later simplified to 11.3.5). Upper bound, as for patch_first.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:03915b20d9723d54…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • CrushFTP 10 before 10.8.5
  • CrushFTP 11 before 11.3.4_23
How we built this timeline

Vendor's account: attackers reverse engineered a code change that had already fixed the bug ('Hackers apparently saw our code change, and figured out a way to exploit the prior bug') and exploited servers that were not up to date, so exploitation began after a fix existed and exploited before a fix=false, even though CrushFTP and others call it a '0-day'. Exploitation may have started a day earlier ('the actual exploits may have been occuring a day earlier').

Severity/CVSS from NVD (9.8); the MITRE-assigned CNA score is 9.0. CVE published 2025-07-18T19:15 UTC per NVD.

Enterprise deployments with a DMZ CrushFTP instance in front were not affected, per CrushFTP.

Related

No related incidents.

CrushFTP report card