CVE-2025-54309

Estado: AnalizadaCrítica (9.8)⚠ Explotación activa

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 9.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 95%
Percentil entre todas las CVEs puntuadas: 100
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

Añadida al catálogo: 22/7/2025
Plazo de remediación: 12/8/2025
Uso conocido en ransomware: Unknown

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access95 %
Impacto principalT1078.001 Default Accountsstealth · persistence · privilege escalation · initial access90 %
Impacto secundarioT1059.001 PowerShellexecution80 %
Impacto secundarioT1098.002 Additional Email Delegate Permissionspersistence · privilege escalation85 %

Vector AV:N/AC:L/PR:N sin interacción apunta a T1190. Validación AS2 defectuosa permite obtener acceso admin remoto. Impactos: obtención de credenciales válidas (T1078.001), creación/modificación de cuentas admin (T1098.002) y ejecución de comandos como admin (T1059.001).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Multi-factor Authentication Disable or Remove Feature or Program Vulnerability Scanning Password Policies Network Segmentation

Tecnologías afectadas (1)

Crushftp — Crushftp

CWE

CWE-420

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-54309",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-54309",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-15T18:50:07.009232Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "CrushFTP",
          "product": "CrushFTP",
          "versions": [
            {
              "status": "affected",
              "version": "10",
              "lessThan": "10.8.5",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "11",
              "lessThan": "11.3.4_23",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-18T19:15:25.353",
  "references": [
    {
      "url": "https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/",
      "tags": [
        "Press/Media Coverage"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/",
      "tags": [
        "Press/Media Coverage"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-420"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025."
    },
    {
      "lang": "es",
      "value": "CrushFTP 10 anterior a 10.8.5 y 11 anterior a 11.3.4_23, cuando no se utiliza la función de proxy DMZ, maneja incorrectamente la validación AS2 y, en consecuencia, permite a atacantes remotos obtener acceso de administrador a través de HTTPS, como se explotó en la naturaleza en julio de 2025."
    }
  ],
  "lastModified": "2026-06-17T09:39:49.643",
  "cisaActionDue": "2025-08-12",
  "cisaExploitAdd": "2025-07-22",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4950EA3-D20F-48B4-BE81-8018EFB452D8",
              "versionEndExcluding": "10.8.5",
              "versionStartIncluding": "10.0.0"
            },
            {
              "criteria": "cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BDC2BCC0-AEA5-4A35-BCAD-6287574D4ED5",
              "versionEndExcluding": "11.3.4_23",
              "versionStartIncluding": "11.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": " CrushFTP Unprotected Alternate Channel Vulnerability"
}