CVE-2023-25909

CRITICAL

Hgiga Oaklouds Portal < 2.0-10 - Unrestricted File Upload

Title source: rule

Description

HGiga OAKlouds file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary command or disrupt service.

References (1)

Core 1

Core References

Third Party Advisory

https://www.twcert.org.tw/tw/cp-132-6973-45872-1.html

Scores

CVSS v3 9.8

EPSS 0.0097

EPSS Percentile 76.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-434

Status published

Products (1)

hgiga/oaklouds_portal 2.0 - 2.0-10

Published Mar 27, 2023

Tracked Since Feb 18, 2026