CVE-2017-2737
HighSummary
VCM5010 with software versions earlier than V100R002C50SPC100 has an arbitrary file upload vulnerability. The software does not validate the uploaded files, allowing an authenticated attacker to upload arbitrary files to the system.
Risk Assessment
An attacker could upload malicious files to the system, potentially compromising security and leading to data loss. The organization is at risk of unauthorized access and potential attacks.
Recommendation
It is recommended to update the software to version V100R002C50SPC100 or later to mitigate this vulnerability. Additionally, implementing file upload validation mechanisms is advisable.
Other vulnerabilities in VCM5010
See all- CVE-2017-2736High
VCM5010 with software versions earlier than V100R002C50SPC100 has a command injection vulnerability. This is due to insufficient validation of user input.
- CVE-2017-2738Critical
VCM5010 with software versions earlier than V100R002C50SPC100 has an authentication bypass vulnerability and an arbitrary file upload vulnerability. An unauthenticated attacker can bypass the login process, while an authenticated attacker can upload unvalidated files to the system.
Original NVD description (English source)
VCM5010 with software versions earlier before V100R002C50SPC100 has an arbitrary file upload vulnerability. The software does not validate the files that uploaded. An authenticated attacker could upload arbitrary files to the system.