CVE-2023-25909

CRITICAL

HGiga OAKlouds Portal 2.0-2.0-10 - Unauthenticated Arbitrary File Upload

Title source: llm
STIX 2.1

Description

HGiga OAKlouds file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary command or disrupt service.

References (1)

Core 1
Core References

Scores

CVSS v3 9.8
EPSS 0.0094
EPSS Percentile 56.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-434
Status published
Products (1)
hgiga/oaklouds_portal 2.0 - 2.0-10
Published Mar 27, 2023
Tracked Since Feb 18, 2026