CVE-2016-8494
HighSummary
Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme.
Risk Assessment
Attackers can exploit this vulnerability to execute arbitrary code remotely, potentially leading to system compromise.
Recommendation
It is recommended to implement strict verification of uploaded files and to limit webui administrator privileges to the minimum necessary.
Other vulnerabilities in webui
See all- CVE-2026-22110High
The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
- CVE-2026-22109High
The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.
- CVE-2025-41692Medium
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm.
Original NVD description (English source)
Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS