A critical zero-day vulnerability in CrushFTP has been disclosed, allowing attackers to achieve remote code execution without authentication.
The vulnerability, tracked as CVE-2025-54309, has received a maximum CVSS score of 9.8 and affects the software's DMZ proxy functionality.
Security researchers have released a proof-of-concept...
A critical zero-day vulnerability in CrushFTP servers has been actively exploited by attackers since July 18th, 2025, with security researchers confirming widespread attacks targeting unpatched installations.
The vulnerability, designated CVE-2025-54309, affects all CrushFTP version 10 installations below 10.8.5 and version 11 installations below 11.3.4_23,...