{"id":11461,"date":"2025-07-21T12:32:35","date_gmt":"2025-07-21T05:32:35","guid":{"rendered":"https:\/\/infosec.new88088.net\/?p=11461"},"modified":"2026-06-25T10:00:05","modified_gmt":"2026-06-25T03:00:05","slug":"zero-day-vulnerability-in-crushftp-allows-admin-permissions-over-web-interface","status":"publish","type":"post","link":"https:\/\/infosec.new88088.net\/en\/2025\/07\/21\/zero-day-vulnerability-in-crushftp-allows-admin-permissions-over-web-interface\/","title":{"rendered":"Zero-day vulnerability in CrushFTP allows admin permissions over web interface"},"content":{"rendered":"
Recently, the software developer CrushFTP \u2013 the FTP – supported enterprise file transfer server platform, SFTp, HTTP\/S, warned of a serious zero – day vulnerability (CVE 2025 54309), which allowed hackers to take remote administration over the web interface.<\/b>
\n\u200b<\/div>\n
\"1753070762963.png\"<\/a>\u200b<\/div>\n
\n

The breach, designated CVE-2025-54309, was rated high-level hazardous (CVSS 9.0) and has been actively exploited since at least July 18,2015.<\/p>\n

CrushFTP is server software used by many organizations to transmit and manage files over protocols such as FTP, SFTp, HTTP\/S, due to its flexibility and high security. However, according to warnings from CrushFTP developers themselves, a vulnerability in the AS2 protocol when processed via HTTP(S) inadvertently opened up the opportunity for hackers to take control of the server without authentication. Although the vulnerability had been indirectly patched in an update in early July, the attacker allegedly reversed the source code and found specific exploit from the previous code change.<\/p>\n

Hackers use this vulnerability to modify or create new system administrator accounts, in many cases modifying default accounts with invalid but working formats. Early identifiers include suspicious changes in the MainUsers\/default\/user.XML file, such as the appearance of unusual last logins fields or strange admin accounts with random names. In addition, the upload\/download log may record unusual behavior if the system has been compromised.<\/p>\n

The affected versions were CrushFTP v10 before 10.8.5 and v11 before 11.3.4 23, released before July 1. Systems that are fully updated or that use a demultiplexing architecture with DMZ proxies are considered safer. However experts recommend that DMZs should not be considered as absolute protection in this case.<\/p>\n

There is currently no confirmation that the data was stolen or that the malware was planted through the attack, but gaining control over the web interface opens up many risks of data leakage, blackmail, or unauthorized long – term access. This is a non-new concern, especially as corporate file transfer systems such as MOVEit, GoAnywhere, and Accellion FTA have been exploited by large groups of ransomware attackers in global campaigns.<\/p>\n

For prevention and response, WhiteHat and security experts recommend that system administrators take the following measures immediately:<\/p>\n<\/div>\n