Zero-Day Drama: CrushFTP Vulnerability Leaves Servers Exposed and Admins Sweating
CrushFTP warns that threat actors are exploiting a zero-day vulnerability, CVE-2025-54309, granting admin access via the web interface. While some users were saved due to a lucky prior patch, others face the threat of unauthorized admin-level usernames. Experts advise regular updates and caution against relying solely on DMZs for safety.
Hot Take:
Patch it once, shame on them. Patch it never, shame on us! CrushFTP’s zero-day tango shows us yet again that in the world of cybersecurity, keeping your software updated is like brushing your teeth – neglected at your own peril!
Key Points:
- CrushFTP is facing a zero-day vulnerability, CVE-2025-54309, exploited via its web interface.
- Threat actors have been active since July 18th, although the party might have started earlier.
- CrushFTP’s accidental heroics previously blocked this flaw unknowingly with a different fix.
- Admins are advised to check for unusual modifications and consider IP whitelisting and DMZ usage.
- Rapid7 warns that relying solely on a DMZ might not be a foolproof mitigation strategy.
Already a member? Log in here