https://pwn.watch/i/crushftp-cve-2025-54309 CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS. Added to CISA KEV on 2025-07-22. en Tue, 22 Jul 2025 00:00:00 GMT https://pwn.watch/i/crushftp-cve-2025-54309 https://pwn.watch/i/crushftp-cve-2025-54309#2025-07-22-4be7a72d Tue, 22 Jul 2025 00:00:00 GMT critical <p>CrushFTP: CrushFTP Unprotected Alternate Channel Vulnerability: CISA added CVE-2025-54309 to the KEV catalog (due 2025-08-12).</p>