Skip to content
Threat Feed
Subscribe

Product

CrushFTP (10.x < 10.8.5, 11.x < 11.3.4_23)

1 brief RSS
critical advisory

CrushFTP: Authentication bypass and administrative account creation (CVE-2025-54309)

CVE-2025-54309 is an authentication bypass vulnerability in CrushFTP allowing unauthenticated administrative account creation via manipulation of the AS2-To header.

CrushFTP authentication-bypass web-exploitation
1r 2t 1c