CVE-2025-54309: CrushFTP Zero-Day Exploited in Global Admin Access Attacks

Daily Security Review

Content provided by Daily Security Review. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Daily Security Review or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://player.fm/legal.

11d ago 22:13

MP3•Episode home

A critical zero-day vulnerability in CrushFTP (CVE-2025-54309) is being actively exploited, giving attackers administrative access to over a thousand unpatched servers globally. This severe security flaw—caused by improper validation in the AS2 protocol—has exposed enterprise-managed file transfer (MFT) systems across the US, Europe, and Canada. Security experts are sounding the alarm, and organizations relying on CrushFTP are urged to patch immediately.

Discovered in mid-July 2025, the bug has been traced to reverse-engineering of recent CrushFTP patches. The vulnerability grants unauthenticated attackers complete control via exposed web interfaces, making it a high-value exploit for data theft, surveillance, and potential ransomware staging. While patched versions (10.8.5 and 11.3.4_23 or later) and properly configured DMZ instances are immune, over 1,000 servers remain vulnerable, according to Shadowserver.

This is not CrushFTP’s first brush with exploitation. A similar zero-day (CVE-2024-4040) was weaponized in April 2024 by espionage-linked actors. A separate authentication bypass (CVE-2025-31161) was publicly exploited just two months ago. The rapid cadence of these exploits underscores the high-stakes environment surrounding MFT tools, which are increasingly targeted by ransomware gangs like Clop and advanced persistent threat (APT) groups.

This episode dives deep into:

The technical root of CVE-2025-54309 and how attackers exploit AS2 mishandling
Indicators of compromise, including rogue admin accounts and fake version numbers
How CrushFTP users can mitigate risk through patching, DMZ deployment, and backup restoration
Why MFT tools have become a goldmine for threat actors—and how to defend them
Best practices: zero trust policies, IP whitelisting, SFTP isolation, and automated encryption

The CrushFTP zero-day is a case study in how unmanaged MFT exposure can lead to catastrophic administrative compromise. If you’re in IT, DevOps, or cybersecurity, this episode is a must-listen to understand the evolving risks in file transfer infrastructure and how to respond effectively before attackers strike.

#CrushFTP #CVE202554309 #ZeroDay #MFTSecurity #ManagedFileTransfer #DataBreach #Cyberattack #AS2Protocol #PatchNow #FileTransferVulnerability #Shadowserver #Infosec #AdminTakeover #Exploit #Cybersecurity #ITSecurity #ClopGang #DataTheft #SFTP #DMZ #EnterpriseSecurity #CyberThreats #ZeroTrust #CVEAlert #CrushFTPExploit

253 episodes

#Tech #News #Tech News #Daily Security Review