Streamax Crocus CVE-2025-11908

No vendor-released patch has been identified at time of analysis, as the vendor did not respond to disclosure attempts. Immediate mitigations include restricting network access to the /FileDir.do endpoint to authorized users only via firewall or reverse proxy rules, disabling the file upload functionality if not operationally required, implementing strict input validation on the File parameter to enforce whitelist-based file type checking (extension and MIME type), and storing uploaded files outside the web root or in a non-executable directory with appropriate file permissions (mode 644 or read-only). Additionally, disable script execution in the upload directory via web server configuration (.htaccess, nginx location blocks, or IIS request filtering). Monitor file system activity for unexpected file creation in upload directories. Contact Streamax for patch availability; if unresponsive, evaluate alternative products or isolated deployment models to contain risk.