CVE-2016-9470
CriticalSummary
Revive Adserver versions before 3.2.5 and 4.0.0 are vulnerable to Reflected File Download (RFD) attacks. Attackers can exploit the vulnerability in `www/delivery/asyncspc.php` to remotely download a file onto the victim's machine.
Risk Assessment
Exploitation of this vulnerability could lead to complete control over the victim's device, posing a serious threat to the organization's data security.
Recommendation
It is recommended to update Revive Adserver to the latest version to mitigate this vulnerability and to monitor systems for unauthorized activities.
Original NVD description (English source)
Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. `www/delivery/asyncspc.php` was vulnerable to the fairly new Reflected File Download (RFD) web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from a trusted domain.