PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-54309 CrushFTP CVE debrief

CVE-2025-54309 is a CrushFTP vulnerability described by CISA as an "Unprotected Alternate Channel Vulnerability." CISA added it to the Known Exploited Vulnerabilities catalog on 2025-07-22, which means defenders should treat it as urgently actionable and verify whether their CrushFTP deployments are protected, mitigated, or no longer in use.

Vendor
CrushFTP
Product
CrushFTP
CVSS
CRITICAL 9
CISA KEV
Listed
Original CVE published
2025-07-22
Original CVE updated
2025-07-22
Advisory published
2025-07-22
Advisory updated
2025-07-22

Who should care

CrushFTP administrators, security operations teams, vulnerability management teams, and incident responders responsible for internet-facing or internally reachable CrushFTP deployments.

Technical summary

The available source data identifies the issue as a CrushFTP "Unprotected Alternate Channel Vulnerability" and records it in CISA’s Known Exploited Vulnerabilities catalog. The KEV inclusion indicates confirmed exploitation risk significant enough to warrant immediate mitigation planning. The supplied corpus does not include additional technical details beyond the vulnerability name and KEV status.

Defensive priority

High. KEV listing indicates active exploitation risk and makes this a time-sensitive remediation item.

Recommended defensive actions

  • Apply mitigations according to vendor instructions as soon as possible.
  • If the product is available as a cloud service in your environment, follow applicable CISA BOD 22-01 guidance.
  • If mitigations are not available or cannot be applied promptly, discontinue use of the product until a safe path is available.
  • Confirm whether any CrushFTP instances are deployed, exposed, or reachable in your environment.
  • Prioritize verification and remediation before the KEV due date of 2025-08-12.
  • Monitor the official CVE and NVD records for any status updates or additional vendor guidance.

Evidence notes

CISA’s KEV entry names the vulnerability as "CrushFTP Unprotected Alternate Channel Vulnerability," lists vendor/product as CrushFTP/CrushFTP, and sets dateAdded to 2025-07-22 with dueDate 2025-08-12. The KEV metadata explicitly instructs defenders to apply vendor mitigations, follow applicable BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable. The supplied corpus also points to the official CVE record and NVD detail page.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-54309 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-54309

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-54309 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-54309

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.