[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fq1CrHE5fTanvBWaz3F6p85NPSYIxB52DNHguWjJWpUM":3,"g5a-risk:CVE-2025-54309":154},{"success":4,"data":5,"meta":151},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":41,"epssPercentile":28,"epssTimeSeries":42,"severity":43,"affectedProducts":44,"affectedProductsCount":49,"references":50,"referencesCount":30,"weaknesses":78,"weaknessesCount":49,"isActivelyExploited":4,"cisaInfo":87,"otxData":28,"relatedBlogPosts":88,"seoMetadata":89,"configurations":114,"relatedVendorCves":129,"notableEvents":130},"CVE-2025-54309","What is CVE-2025-54309?","CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.","CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers...","2025-07-18T19:15:25.353","2025-11-05T19:25:42.887",9.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":39,"CVSSMetricV2":40,"CVSSMetricV40":28},[16,31],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":29,"ImpactScore":30},"cve@mitre.org","Secondary",{"Version":20,"VectorString":21,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":24,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":23,"BaseScore":26,"BaseSeverity":27,"ExploitCodeMaturity":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"TemporalSeverity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":28,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedScope":28,"ModifiedConfidentialityImpact":28,"ModifiedIntegrityImpact":28,"ModifiedAvailabilityImpact":28,"EnvironmentalScore":28,"EnvironmentalSeverity":28},"3.1","CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:H\u002FA:H","NETWORK","HIGH","NONE","CHANGED",9,"CRITICAL",null,2.2,6,{"Source":32,"Type":33,"CVSSData":34,"ExploitabilityScore":37,"ImpactScore":38},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":22,"AttackComplexity":35,"PrivilegesRequired":24,"UserInteraction":24,"Scope":36,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":23,"BaseScore":12,"BaseSeverity":27,"ExploitCodeMaturity":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"TemporalSeverity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":28,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedScope":28,"ModifiedConfidentialityImpact":28,"ModifiedIntegrityImpact":28,"ModifiedAvailabilityImpact":28,"EnvironmentalScore":28,"EnvironmentalSeverity":28},"LOW","UNCHANGED",3.9,5.9,[],[],0.95112,[41,41,41,41,41,41,41],"Critical",[45],{"vendor":46,"product":46,"version":47,"criteria":48,"vulnerable":4},"crushftp","*","cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*",1,[51,56,61,65,70,73],{"url":52,"source":53,"tags":54},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcrushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers\u002F","Bleepingcomputer",[55],"Press\u002FMedia Coverage",{"url":57,"source":58,"tags":59},"https:\u002F\u002Fwww.crushftp.com\u002Fcrush11wiki\u002FWiki.jsp?page=CompromiseJuly2025","Crushftp",[60],"Vendor Advisory",{"url":62,"source":63,"tags":64},"https:\u002F\u002Fwww.rapid7.com\u002Fblog\u002Fpost\u002Fcrushftp-zero-day-exploited-in-the-wild\u002F","Rapid7",[55],{"url":66,"source":67,"tags":68},"https:\u002F\u002Fwww.vicarius.io\u002Fvsociety\u002Fposts\u002Fcve-2025-54309-detect-crushftp-vulnerability","Vicarius",[69],"Third Party Advisory",{"url":71,"source":67,"tags":72},"https:\u002F\u002Fwww.vicarius.io\u002Fvsociety\u002Fposts\u002Fcve-2025-54309-mitigate-crushftp-vulnerability",[69],{"url":74,"source":75,"tags":76},"https:\u002F\u002Fwww.cisa.gov\u002Fknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54309","CISA",[77],"US Government Resource",[79],{"id":80,"name":81,"description":82,"extendedDescription":83,"status":84,"abstraction":85,"structure":86},"CWE-420","Unprotected Alternate Channel","The product protects a primary channel, but it does not use the same level of protection for an alternate channel.","","Draft","Base","Simple",{"shortDescription":83,"requiredAction":83,"vulnerabilityName":83,"dateAdded":28},[],{"title":90,"metaDescription":91,"keywords":92,"canonicalUrl":93,"structuredData":94},"What is CVE-2025-54309? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2025-54309, a critical severity cyber security vulnerability from 2025. High exploit probability (95.1%). CrushFTP 10 before 10...","CVE-2025-54309, CVE-2025-54309 vulnerability, CVE-2025-54309 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2025, CVSS score, exploit, patch, remediation, crushftp security, crushftp vulnerability, high risk vulnerability, actively exploited, exploit available","\u002Fwhat-is\u002Fcve-2025-54309",{"@context":95,"@type":96,"headline":90,"description":91,"datePublished":10,"dateModified":11,"author":97,"publisher":101,"about":105,"mainEntityOfPage":109,"articleSection":112,"keywords":113},"https:\u002F\u002Fschema.org","TechArticle",{"@type":98,"name":99,"url":100},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":98,"name":99,"url":100,"logo":102},{"@type":103,"url":104},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":106,"name":6,"description":107,"additionalType":108},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":110,"@id":111},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2025-54309","Cybersecurity","CVE-2025-54309, CVE-2025-54309 vulnerability, CVE-2025-54309 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[115],{"Operator":28,"Negate":28,"Nodes":116},[117],{"Operator":118,"Negate":119,"CPEMatch":120},"OR",false,[121,125],{"Vulnerable":4,"Criteria":48,"MatchCriteriaID":122,"VersionStartExcluding":28,"VersionStartIncluding":123,"VersionEndExcluding":124,"VersionEndIncluding":28},"A4950EA3-D20F-48B4-BE81-8018EFB452D8","10.0.0","10.8.5",{"Vulnerable":4,"Criteria":48,"MatchCriteriaID":126,"VersionStartExcluding":28,"VersionStartIncluding":127,"VersionEndExcluding":128,"VersionEndIncluding":28},"BDC2BCC0-AEA5-4A35-BCAD-6287574D4ED5","11.0.0","11.3.4_23",[],[131,138,145],{"id":132,"eventType":133,"eventTime":134,"details":135,"label":136,"color":137},"5c7cbed5-681b-4ba8-8d45-0c9f60111456","NEW_NVD","2025-07-19T04:00:58.283754+00:00","New CVE added to NVD","Published to NVD","blue",{"id":139,"eventType":140,"eventTime":141,"details":142,"label":143,"color":144},"7850f4cc-34a8-49f7-a0d6-fbf4659388c0","NEW_CISA","2025-07-23T04:00:57.107166+00:00","CVE added to CISA Known Exploited Vulnerabilities","Added to CISA KEV","red",{"id":146,"eventType":147,"eventTime":148,"details":149,"label":150,"color":144},"9a3ae332-bdaa-4a23-9d39-841240719701","HIGH_EPSS_DELTA","2025-08-30T04:06:02.478107+00:00","Daily EPSS score increased by 0.297 on 2025-07-20","EPSS Score Increased",{"lastModified":11,"cacheTime":152,"version":153},1792249090900,"2.0",{"score":155,"band":43,"action":156,"scoredAt":157},90,"Emergency patch","2026-10-16T07:08:06.682662+00:00"]