by Kastro
Paper/Archive/CVE-2023-25909

CVE-2023-25909

HGIGA INC. HGiga OAKlouds — HGiga Inc. OAKlouds - Arbitrary File Upload

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 61.0.610 × 2012.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

HGiga OAKlouds file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary command or disrupt service.

Affected

ProductAffectedFixed inSource
HGiga OAKlouds2–CNA
HGiga OAKlouds3–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reftwcert.org.tw/tw/cp-132-6973-45872-1.html