Welotec: Path Traversal in SmartEMS Upload Handling
Advisory ansehen veröffentlicht 2025-09-10
A path traversal flaw in the SmartEMS upload handling allows authenticated users to direct upload data outside of the intended directory via the 'Upload-Key' header. In deployments where writable, code-interpreted paths are reachable, this may lead to remote code execution.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-41714US | — | — | ||
The upload endpoint insufficiently validates the 'Upload-Key' request header. By supplying path traversal sequences, an authenticated attacker can cause the server to create upload… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
03
Behebungen (2)
- MitigationSmartEMS Web Application
Restrict access to the SmartEMS Web UI to trusted admin networks/VPN. Enforce strong credentials and rotate or revoke active tokens/sessions.
- BehobenSmartEMS Web Application
Update SmartEMS to version 3.3.6 or later.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan