Exploited vulnerabilitiesBriefPublic record
CrushFTP auth bypass (CVE-2025-31161, Mar/Apr 2025; CVE-2025-54309, Jul 2025)
CVE-2025-31161: KEV 7 Apr 2025. Disclosure was messy (CVE-2025-2825 dispute).
- Disclosed
What happened
- CVE-2025-54309: AS2 validation flaw exploited as a zero-day on 18 Jul 2025. KEV 22 Jul 2025.
- Fixed: 10.8.5 and 11.3.4_23 for 2025-54309.
Live scores
Live scores
CVE-2025-2825- EPSS
- 0.000
low predicted chance of attack - VEDAS
- 0.986
strong exploit evidence - On CISA KEV
- Not listed
Live scores
CVE-2025-31161- EPSS
- 1.000
very likely to be attacked soon - VEDAS
- 0.986
strong exploit evidence - On CISA KEV
- Yes, since 2025-04-07
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2025-54309- EPSS
- 0.935
very likely to be attacked soon - VEDAS
- 0.982
strong exploit evidence - On CISA KEV
- Yes, since 2025-07-22
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025
- https://nvd.nist.gov/vuln/detail/CVE-2025-54309
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.