github.comexploit
https://github.com/Yu1e/vuls/blob/main/an%20arbitrary%20file%20upload%20vulnerability%20in%20BaiZhuo%20Networks%20Smart%20S210%20multi-service%20security%20gateway%20intelligent%20management%20platform.md CVE-2024-0939
MEDIUMNuclei
Byzoro Smart S210 Management Platform uploadfile.php unrestricted upload
Record summary
CVE-2024-0939 has a selected CVSS score of 6.3 (medium); EIP currently links 1 Nuclei template.
Description
A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252184. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated May 8, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Smart S210 Management PlatformBrowse Byzoro / Smart S210 Management Platform | CVE List | 20240117 | affected |
Nuclei templates
1ProjectDiscoveryCRITICALSmart S210 Management Platform - Arbitary File UploadCVSS 9.8
A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload.
Impact
Unauthenticated attackers can upload arbitrary PHP files through the uploadfile.php component and execute malicious code on the server, potentially compromising the entire Smart S210 management platform and connected IoT devices.
Remediation
Update Byzoro Smart S210 firmware to a version newer than 20240117 that validates file types, restricts executable uploads, and implements proper access controls on the upload functionality.
WeaknessesCWE-434
AuthorsDhiyaneshDk
Template tagscvecve2024smartfile-uploadintrusivercevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:o:byzoro:smart_s210_firmware:*:*:*:*:*:*:*:*
FOFA: body="Smart管理平台"
https://nvd.nist.gov/vuln/detail/CVE-2024-0939 https://vuldb.com/?ctiid.252184 https://vuldb.com/?id.252184 https://vuldb.com/?submit.269268 https://github.com/tanjiti/sec_profile
Source: ProjectDiscovery
References
5nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-0939 VDB-252184 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions required
https://vuldb.com/?ctiid.252184 VDB-252184 | Byzoro Smart S210 Management Platform uploadfile.php unrestricted uploadvdb entryTechnical description
https://vuldb.com/?id.252184 Submit #269268 | Beijing Baizhuo Network Technology Co., Ltd. Smart S210 multi-service security gateway intelligent management platform Smart S210 arbitrary file upload vulnerabilityThird-party advisory
https://vuldb.com/?submit.269268