Over 1,000 CrushFTP cases presently uncovered on-line are susceptible to hijack assaults that exploit a crucial safety bug, offering admin entry to the online interface.
The safety vulnerability (CVE-2025-54309) is because of mishandled AS2 validation and impacts all CrushFTP variations beneath 10.8.5 and 11.3.4_23. The seller tagged the flaw as actively exploited within the wild on July nineteenth, noting that assaults might have begun earlier, though it has but to seek out proof to substantiate this.
“July 18th, 9AM CST there’s a 0-day exploit seen within the wild. Presumably it has been occurring for longer, however we noticed it then. Hackers apparently reverse engineered our code and located some bug which we had already mounted,” reads CrushFTP’s advisory
“They’re exploiting it for anybody who has not stayed present on new variations. As all the time we suggest usually and frequent patching. Anybody who had stored updated was spared from this exploit.”
Nevertheless, CrushFTP added final week that servers which were stored updated aren’t susceptible to assaults, stating that clients who use a demilitarized zone (DMZ) occasion to isolate their most important server aren’t impacted by this vulnerability.
The corporate additionally recommends reviewing add and obtain logs for uncommon exercise, in addition to enabling automated updates and whitelisting IPs for server and admin entry to additional mitigate exploitation makes an attempt.
In keeping with scans from the safety risk monitoring platform Shadowserver, roughly 1,040 CrushFTP cases stay unpatched in opposition to CVE-2025-54309 and are susceptible to assaults.
ShadowServer is now notifying CrushFTP clients that their servers are unprotected in opposition to ongoing CVE-2025-54309 exploitation, exposing their contents to information theft makes an attempt.
Whereas it is unclear if these ongoing assaults deploy malware or had been used for information theft, managed file switch options like CrushFTP have been high-value targets for ransomware gangs in recent times.
As an illustration, the Clop cybercrime gang alone has been linked to a number of information theft campaigns concentrating on zero-day flaws in Accelion FTA, GoAnywhere MFT, MOVEit Switch, and, most not too long ago, Cleo software program.
One yr in the past, in April 2024, CrushFTP additionally patched an actively exploited zero-day (tracked as CVE-2024-4040) that allowed unauthenticated attackers to flee the consumer’s digital file system (VFS) and obtain system information.
On the time, the cybersecurity firm CrowdStrike discovered proof that the assaults, which focused CrushFTP cases at a number of U.S. organizations and targeted on intelligence gathering, had been doubtless politically motivated.
Include rising threats in actual time – earlier than they affect your small business.
Learn the way cloud detection and response (CDR) provides safety groups the sting they want on this sensible, no-nonsense information.
