Over 1,000 CrushFTP cases at the moment uncovered on-line are susceptible to hijack assaults that exploit a vital safety bug, offering admin entry to the online interface.
The safety vulnerability (CVE-2025-54309) is because of mishandled AS2 validation and impacts all CrushFTP variations beneath 10.8.5 and 11.3.4_23. The seller tagged the flaw as actively exploited within the wild on July nineteenth, noting that assaults could have begun earlier, though it has but to search out proof to verify this.
“July 18th, 9AM CST there’s a 0-day exploit seen within the wild. Presumably it has been happening for longer, however we noticed it then. Hackers apparently reverse engineered our code and located some bug which we had already fastened,” reads CrushFTP’s advisory
“They’re exploiting it for anybody who has not stayed present on new variations. As at all times we suggest frequently and frequent patching. Anybody who had saved updated was spared from this exploit.”
Nevertheless, CrushFTP added final week that servers which have been saved updated usually are not susceptible to assaults, stating that prospects who use a demilitarized zone (DMZ) occasion to isolate their fundamental server aren’t impacted by this vulnerability.
The corporate additionally recommends reviewing add and obtain logs for uncommon exercise, in addition to enabling computerized updates and whitelisting IPs for server and admin entry to additional mitigate exploitation makes an attempt.
In keeping with scans from the safety menace monitoring platform Shadowserver, roughly 1,040 CrushFTP cases stay unpatched towards CVE-2025-54309 and are susceptible to assaults.
ShadowServer is now notifying CrushFTP prospects that their servers are unprotected towards ongoing CVE-2025-54309 exploitation, exposing their contents to knowledge theft makes an attempt.
Whereas it is unclear if these ongoing assaults deploy malware or had been used for knowledge theft, managed file switch options like CrushFTP have been high-value targets for ransomware gangs lately.
For example, the Clop cybercrime gang alone has been linked to a number of knowledge theft campaigns concentrating on zero-day flaws in Accelion FTA, GoAnywhere MFT, MOVEit Switch, and, most lately, Cleo software program.
One yr in the past, in April 2024, CrushFTP additionally patched an actively exploited zero-day (tracked as CVE-2024-4040) that allowed unauthenticated attackers to flee the consumer’s digital file system (VFS) and obtain system information.
On the time, the cybersecurity firm CrowdStrike discovered proof that the assaults, which focused CrushFTP cases at a number of U.S. organizations and targeted on intelligence gathering, had been probably politically motivated.
CISOs know that getting board buy-in begins with a transparent, strategic view of how cloud safety drives enterprise worth.
This free, editable board report deck helps safety leaders current danger, influence, and priorities in clear enterprise phrases. Flip safety updates into significant conversations and sooner decision-making within the boardroom.
