iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
CrushFTP disclosed that attackers were exploiting CVE-2025-54309 in the wild by July 18, 2025. The flaw could let an attacker gain administrative access through the web interface. A report published July 22, 2025, citing Shadowserver data, said just under 1,000 organizations remained vulnerable at that time; that was an exposure estimate, not a count of confirmed compromises, and it is not a current total.
What happened in the CrushFTP zero-day incident?
CrushFTP said it observed exploitation at 9 a.m. CST on July 18, 2025, while noting that attacks might have begun earlier. The vendor described an HTTP(S) attack path and said attackers reverse-engineered a code change to exploit builds that had not been kept current. CERT-EU independently characterized the issue as allowing attackers to obtain administrative access through CrushFTP’s web interface.
This article concerns CVE-2025-54309. It is distinct from the earlier CrushFTP vulnerabilities CVE-2025-31161, an authentication bypass, and CVE-2024-4040, a VFS sandbox escape. Those are separate issues with different affected-version ranges; an advisory or patch for one should not be treated as resolving another.
How many servers or organizations were affected?
TechRadar reported on July 22, 2025, citing Shadowserver data, that just under 1,000 organizations were still vulnerable. The figure describes systems believed to remain exposed at that point in time. It does not establish how many were successfully attacked, and no confirmed victim total is established by the cited sources. It should not be presented as a current scan or current exposure count.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Which CrushFTP versions were affected?
CrushFTP and CERT-EU identified these historical thresholds for CVE-2025-54309:
| Branch | Affected builds |
|---|---|
| Version 10 | All builds below 10.8.5 |
| Version 11 | All builds below 11.3.4_23 |
CrushFTP said version 11.3.5 and later were safe. These are the versions identified in the July 2025 advisories, not a substitute for checking the vendor’s current security and download information. Administrators should verify the installed branch and exact build, then move to a currently supported, security-updated release.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Does a DMZ deployment change the risk?
CrushFTP said enterprise customers using a DMZ CrushFTP instance in front of the main server were not affected by this particular vulnerability. Treat that as the vendor’s statement about CVE-2025-54309—not as a general guarantee that a DMZ prevents compromise or protects against other flaws.
Recommended Free Tools
What should administrators do?
- Identify the installed build. Check the CrushFTP branch and exact build on every relevant instance, including any DMZ instance, and compare it with the vendor’s current security guidance.
- Update promptly. Install the current applicable CrushFTP security update. If an instance is below the historical affected thresholds, do not assume that applying an old minimum version is sufficient; confirm the currently recommended release with CrushFTP.
- Check for indicators of compromise. Review for an unexpected administrator default user, unknown long random user IDs, newly created administrator accounts, missing end-user interface controls, or an unexpected Admin button. CERT-EU also calls out a recent modification to
MainUsers/default/user.XMLor alast_loginsfield in that file. - If compromise is suspected, preserve evidence and investigate. Follow your incident-response process and preserve relevant logs and evidence. CrushFTP advises restoring a prior backup of the default user, reviewing upload and download reports, and considering a restore point from before the suspected activity. Coordinate recovery with incident responders rather than treating a patch alone as remediation.
- Reduce future exposure. CrushFTP recommends restricting administration by IP, whitelisting connections, using a DMZ instance for enterprise deployments, and enabling frequent automatic updates. These are vendor recommendations; assess them against your own environment and security policy.
How this incident differs from other CrushFTP CVEs
Do not use the July 2025 version thresholds to assess the separate vulnerabilities. The Canadian Centre for Cyber Security describes CVE-2025-31161 as affecting CrushFTP versions 10.0.0–10.8.3 and 11.0.0–11.3.0; it also reports that the CVE was added to CISA’s Known Exploited Vulnerabilities catalog on April 7, 2025. NVD’s search result for CVE-2024-4040 describes that flaw as affecting versions before 10.7.1 and 11.1.0. Administrators should assess each CVE separately against its applicable vendor guidance.
Quick Recap
Rank #4
- Runs UniFi Network for full-stack network management
- Manages 30+ UniFi Network devices and 300+ clients
- 1 Gbps routing with IDS/IPS
- Multi-WAN load balancing
- 0.96" LCM status display
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
Sources
- CrushFTP: July 2025 zero-day incident notice
- CERT-EU: CrushFTP zero-day exploited in the wild
- TechRadar: July 22, 2025 report on organizations still vulnerable
- Canadian Centre for Cyber Security: CVE-2025-31161 alert
- NVD search results for CVE-2024-4040
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
