CrushFTP Chaos: Critical Security Flaw Exploited by Hackers – Update Now!
CrushFTP’s critical security flaw, CVE-2025-54309, with a CVSS score of 9.0, is actively exploited. Without DMZ proxy, hackers can gain admin access via HTTPS, posing a threat to sensitive data transfers in government and enterprise environments. Ensure your CrushFTP is updated to avoid being the latest victim of this cyber comedy of errors!
Hot Take:
Looks like CrushFTP is getting crushed by hackers! With a vulnerability score of 9.0, this flaw is more critical than forgetting your mom’s birthday. Time to patch up, or you might end up with more problems than a soap opera protagonist!
Key Points:
- CVE-2025-54309 is a critical CrushFTP vulnerability with a CVSS score of 9.0, allowing admin access via HTTPS when DMZ proxy is not used.
- The vulnerability is actively exploited, having been first detected on July 18, 2025, but possibly weaponized earlier.
- Indicators of compromise (IoCs) include admin access anomalies and modifications to specific user files.
- Mitigations involve IP restrictions, enabling automatic updates, and using a DMZ instance.
- Previous critical vulnerabilities in CrushFTP have been exploited, highlighting the need for rigorous security practices.
Already a member? Log in here