In our latest Exploits Explained blog, SRT researcher IronRoot took CVE-2025-54309—an authentication bypass vulnerability in CrushFTP—further than any existing public exploit had gone. When the internet's PoCs didn't deliver meaningful impact, he didn't stop. He dug into legacy CrushFTP source code on GitHub, identified undocumented admin command handlers, and used AI-assisted exploit development to build something new. The result? Real-world impact: dumped server credentials (including cleartext passwords), active session data, internal infrastructure endpoints, and full server logs containing session cookies. Read the full technical breakdown: https://www.synack.com/exploits-explained/beyond-the-public-poc-deep-diving-cve-2025-54309/?utm_campaign=5710519-PTAAS-FY26&utm_source=organic-social&utm_channel=twitter&utm_medium=organic-social&utm_audience=general&utm_content=ironroot-cve-20205-54309
Post summary
The post explains that SRT researcher IronRoot crafted a novel exploit for CVE‑2025‑54309, achieving real‑world credential theft and system data extraction—highlighting the availability of a functional exploit and active exploitation.
