CVE-2023-34855
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A Cross Site Scripting (XSS) vulnerability in Youxun Electronic Equipment (Shanghai) Co., Ltd AC Centralized Management Platform v1.02.040 allows attackers to execute arbitrary code via uploading a crafted HTML file to the interface /upfile.cgi.
Risk Assessment
This vulnerability could lead to remote code execution, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to update the platform to the latest version and implement validation filters for uploaded files to minimize the risk of XSS attacks.
Original NVD description (English source)
A Cross Site Scripting (XSS) vulnerability in Youxun Electronic Equipment (Shanghai) Co., Ltd AC Centralized Management Platform v1.02.040 allows attackers to execute arbitrary code via uploading a crafted HTML file to the interface /upfile.cgi.