VendorsEnterprise apps
CrushFTP
CrushFTP makes the CrushFTP managed file transfer server.
- Response trend, 6 months
- Not enough history
- Open now
- None
- Latest incident
- 18 Jul 2025
- Incidents on record
- 2
Response to exploited bugs
Not rated. No reviewed zero-days yet.
Fixing privately reported bugs
Not rated. No private reports in the grading window.
What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work
Why these grades
Every clock starts at the first public report.
- Response to exploited bugs: not rated. No reviewed exploited zero-days in the last 36 months, so this grade does not apply yet.
- Fixing privately reported bugs: not rated. No private reports in the last 36 months.
- 2 of 2 reviewed exploited bugs had a public fix before exploitation was reported. They do not count toward the response grade.
- NR (not rated) means a subject has fewer than 3 data points from the last 36 months, or their recency weights add up to less than one current data point. For response, a data point is a reviewed exploited zero-day. For private fixes, it is a private report (one vendor, one report date). KEV listings alone never rate a vendor. A grade is provisional when the vendor's own evidence does not yet outweigh the starting value, or confidence is below medium.
Response to exploited bugs: sub-scores
- Time to first advisoryNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- Time to first fixNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- Time to fix all versionsNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- OpennessNo machine-readable advisory feed listed. No public alert channel listed.252 cases, low confidence, not used for this vendor
Fixing privately reported bugs: sub-score
- Private fix speedNo private reports in the last 36 monthsNR0 cases, not used
Response fingerprint
Counts toward the response grade 0
No incidents count toward the grade yet.
Not graded 2: n-days, unreviewed timelines and end-of-life products
- 18 Jul 2025CrushFTP unauthenticated admin access via HTTP(S) (AS2 validation flaw, July 2025)Not graded: n-day
- 21 Mar 2025CrushFTP unauthenticated HTTP(S) authentication bypass (March 2025)Not graded: n-day
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Open, no fix
- Open, partly fixed
- Fixed when disclosed
- Date only, no time of day
One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.
Exploited incidents
2 in 24 months, 1 with known ransomware use, 0% exploited before a fix
| First report | Incident | CVSS | Silence | First fix | All fixed | Status | Grade |
|---|---|---|---|---|---|---|---|
| 18 Jul 2025 | CrushFTP unauthenticated admin access via HTTP(S) (AS2 validation flaw, July 2025)CVE-2025-54309 | 9.8 | same day | same day | same day | Fixed | Not graded: n-day |
| 21 Mar 2025 | CrushFTP unauthenticated HTTP(S) authentication bypass (March 2025)CVE-2025-31161 | 9.8 | same day | same day | same day | Fixed | Not graded: n-day |
Private reports
None in the window
Bugs reported privately to CrushFTP by ZDI or Project Zero.
No privately reported cases from ZDI or Project Zero in the window.
Grade history
Response to exploited bugs: score at the end of each month.
Not rated at any point in this period.
Channels
Get CrushFTP's own alerts
- Advisory pageCrushFTP 11 wiki: Update page (Vulnerability Info)Check the advisory page. It has no push channel.
- Advisory pageCrushFTP 11 version historyCheck the advisory page. It has no push channel.
What we watch
- Advisory pageCrushFTP 11 wiki: Update page (Vulnerability Info)
- Advisory pageCrushFTP 11 version history
See sources and health for when each was last read.
Grade not rated.