Historical catalog analysis: CISA added this entry on July 22, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2025-54309 is an unprotected alternate channel vulnerability (CWE-420) identified in CrushFTP. The flaw stems from the mishandling of AS2 validation. Under specific configuration conditions, this allows a remote attacker to obtain administrative access to the system via HTTPS.
Exposure and applicability
This vulnerability specifically affects CrushFTP deployments where the DMZ proxy feature is not in use. Organizations utilizing the DMZ proxy may have a different exposure profile, but those with direct HTTPS exposure and disabled or absent DMZ proxy configurations are at higher risk of unauthorized administrative takeover.
Remediation priorities
Based on the inclusion of this vulnerability in the CISA Known Exploited Vulnerabilities catalog as of July 22, 2025, remediation should be prioritized for all exposed instances. Our analysis suggests the following priority sequence:
- Immediate Mitigation Application: Apply vendor-provided mitigations according to official instructions. This is the primary path to reducing the immediate risk of administrative compromise.
- Cloud Service Review: For organizations utilizing CrushFTP via cloud services, review and apply guidance consistent with BOD 22-01 to ensure provider-side exposure is addressed.
- Decommissioning: If vendor mitigations cannot be applied or are unavailable for a specific legacy environment, the product should be discontinued to eliminate the attack surface.
How to validate remediation
Verification of this fix requires more than a version check, as the vulnerability is tied to how AS2 validation is handled in the absence of a DMZ proxy. Defenders should verify that:
* The vendor-specified mitigation steps have been fully executed and confirmed across all instances.
* If the DMZ proxy was implemented as a compensating control, its configuration is validated to ensure it correctly intercepts and handles traffic before it reaches the core AS2 validation logic.
Confirmation of remediation is achieved when the specific path allowing administrative access via HTTPS—bypassing AS2 validation—is closed.
Limits and open questions
There is currently no confirmed data regarding whether this vulnerability has been utilized by known ransomware campaigns. Additionally, while CISA has set a remediation deadline of August 12, 2025, for federal agencies, this date serves as a risk indicator rather than a mandatory requirement for private sector entities. Residual risk remains if the DMZ proxy is enabled but misconfigured, or if other alternate channels exist that bypass the primary validation logic.
Source and editorial note
CVE-2025-54309: CrushFTP Unprotected Alternate Channel Vulnerability · Source date: July 22, 2025 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: July 25, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 08, 2026 at 00:20 UTC.
Request a Vulnerability Assessment
Turn security intelligence into action.
Discuss your exposure, priorities, and the evidence needed to validate the outcome.
Request a security assessment ↗