PoC Available: CrushFTP Zero-Day (CVE-2025-54309) Exploited in the Wild

CrushFTP has a zero-day authentication bypass vulnerability, CVE-2025-54309, that has already been exploited in the wild and enables remote attackers to gain full administrative control via a race condition in HTTP request handling. watchTowr Labs’ analysis notes that the flaw affects CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, with the DMZ proxy feature not being affected, and that administrative access can be achieved by abusing the built-in crushadmin account during the race.

The exploitation was observed in July 2025, and the flaw was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on 22 July 2025, with large-scale attempts recorded—1,190 occurrences of the first request and 1,192 of the second. The PoC honeypot from watchTowr’s Attacker Eye shows two HTTP requests used in tandem; neither alone succeeded, but together they allowed creation of a persistent backdoor.

Mitigations include updating to CrushFTP 10.8.5 or 11.3.4_23, monitoring HTTP logs for paired requests with the AS2-TO: \\crushadmin header, and reviewing accounts for unauthorised administrative users.