Administrative Access Risk in CrushFTP File Transfers

Historical catalog analysis: CISA added this entry on July 22, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-54309 describes an unprotected alternate channel vulnerability within CrushFTP. The flaw occurs when the system mishandles AS2 validation, which could allow a remote attacker to obtain administrative access to the server via HTTPS.

Exposure and applicability

This vulnerability specifically affects CrushFTP deployments where the DMZ proxy feature is not utilized. In healthcare environments, CrushFTP is frequently employed by providers and business associates to facilitate the secure transfer of large datasets, which often include electronic Protected Health Information (ePHI). Because this flaw allows for administrative-level access, an attacker could potentially bypass standard user permissions to access, modify, or delete sensitive patient data stored on the server.

Remediation priorities

Based on our analysis of the vulnerability, healthcare IT and security leaders should prioritize the following actions to reduce risk:

1. Configuration Audit: Immediately determine if the CrushFTP deployment is utilizing the DMZ proxy feature. Systems not using this feature are explicitly identified as vulnerable.
2. Vendor Mitigation Application: Apply the mitigations provided by the vendor. For those utilizing cloud services, we recommend following applicable BOD 22-01 guidance where relevant to their service model.
3. Service Evaluation: In instances where mitigations cannot be applied or verified, organizations should evaluate whether to discontinue use of the product to prevent unauthorized administrative access.

How to validate remediation

To verify that exposure has been reduced, administrators should coordinate with their security teams to confirm the successful application of vendor-supplied patches or configuration changes. Validation should focus on confirming that the specific conditions allowing the AS2 validation bypass are no longer present. We recommend reviewing system logs for unauthorized administrative login attempts during the transition period.

Limits and open questions

It remains unknown whether this vulnerability has been leveraged in active ransomware campaigns. Additionally, while the DMZ proxy feature is mentioned as a factor in the vulnerability’s applicability, organizations should refer to official vendor documentation to determine if that feature alone provides sufficient protection or if additional patches are required. There is residual risk associated with any administrative access flaw, as such access typically grants broad control over the hosted data and system configurations.

Source and editorial note

CVE-2025-54309: CrushFTP Unprotected Alternate Channel Vulnerability · Source date: July 22, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: July 25, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 05, 2026 at 00:50 UTC.

Request a healthcare security assessment