CVE-2023-4739
MediumCVSS 6.3Exploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
A critical vulnerability has been found in the Byzoro Smart S85F Management Platform up to version 20230820. The issue affects an unknown functionality of the file /sysmanage/updateos.php, allowing unrestricted file uploads through manipulation of the argument 1_file_upload.
Risk Assessment
An attacker can remotely exploit this vulnerability to upload malicious files, potentially leading to system compromise. As a result, the organization is exposed to serious security threats.
Recommendation
It is recommended to immediately update the platform to the latest version and restrict access to the file /sysmanage/updateos.php. Additionally, the system should be monitored for unauthorized activities.
Original NVD description (English source)
A vulnerability, which was classified as critical, has been found in Byzoro Smart S85F Management Platform up to 20230820. Affected by this issue is some unknown functionality of the file /sysmanage/updateos.php. The manipulation of the argument 1_file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238628. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.