Critical Admin Access Vulnerability in CrushFTP (CVE‑2025‑54309) – Unprotected Alternate Channel
What It Is – CrushFTP’s DMZ‑proxy feature includes an alternate‑channel path that, when not enabled, mishandles AS2 validation. An unauthenticated remote attacker can exploit this flaw over HTTPS to obtain full administrative privileges.
Exploitability – The vulnerability is publicly disclosed in CISA’s Known Exploited Vulnerabilities list; a proof‑of‑concept exists, and the CVSS v3.1 base score is 9.8 (Critical). No public exploit‑as‑a‑service has been observed yet, but the risk of active exploitation is high.
Affected Products – All versions of CrushFTP server that expose the DMZ‑proxy feature without the optional protection flag (the vendor has not yet released a patched version at the time of writing).
Why It Matters for Trust & Control Assurance
- Privileged‑access controls – The flaw bypasses normal authentication, highlighting gaps in the “admin‑only” control area that must be continuously monitored and evidenced.
- Third‑party software oversight – Relying on an external file‑transfer solution without verified hardening creates a supply‑chain risk; auditors now expect documented assurance that such components meet your control objectives.
- Defensible audit trail – Demonstrating that you have logged, reviewed, and remediated privileged‑access anomalies is a key piece of evidence for any SOC 2, ISO 27001, or NIST CSF audit.
Recommended Actions
- Apply the vendor‑released patch (or upgrade to the latest version) immediately.
- If the DMZ‑proxy feature is not required, disable it to eliminate the unprotected channel.
- Enforce least‑privilege for all CrushFTP accounts and rotate admin credentials.
- Enable detailed logging of all admin‑level actions and integrate logs into your SIEM for continuous monitoring.
- Document the remediation steps and update your control‑mapping evidence repository.
Source: CISA KEV – CVE‑2025‑54309