Security Advisory

CVE-2025-54309

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2025-07-18 00:00:00

Last updated 2025-10-21 22:45:21

Assigner mitre

CVSS score 9.0

State PUBLISHED

Description

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

← Browse all CVEs View on cve.org ↗