Paper/Archive/CVE-2025-4556

CVE-2025-4556

ZONG YU Okcat Parking Management Platform — ZONG YU Okcat Parking Management Platform - Arbitrary File Upload

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 56.2.562 × 2011.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The web management interface of Okcat Parking Management Platform from ZONG YU has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Affected

ProductAffectedFixed inSource

Okcat Parking Management Platformall versions–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

twcert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-10110-114f0-1.html writeuptwcert.org.tw/en/cp-139-10111-b78e6-2.html