ARKETEAM Protectel CVE-2025-68391

Exploitation requires network reach to the affected ARKETEAM Protectel module (PROTECTELMAJ <6.5.19 or BDF <6.4.67); per the vendor CVSS 4.0 vector the upload path is adjacent-network and unauthenticated (AV:A/PR:N), meaning the attacker needs access to the same adjacent network segment rather than the open internet. The key limiting factor is that the harmful JavaScript execution does NOT occur on upload - the description states it is triggered only 'when an authenticated user tries to download the uploaded file,' so a second, authenticated victim must retrieve the attacker-overwritten file in the temporary folder for impact to materialize. This victim-download dependency and the adjacent-network reachability constraint substantially narrow realistic exploitation despite the unauthenticated upload step.

This is a medium-severity issue (vendor CVSS 4.0 base 5.3) that should be treated as a scheduled-patch item rather than an emergency, consistent with the vuln.today 'this_month' decision label. The signals are internally coherent but modest: the vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes an adjacent-network, low-complexity, unauthenticated upload with only Low integrity impact to the vulnerable and subsequent systems (VI:L/SI:L) and no confidentiality or availability impact (VC:N/VA:N/SA:N) - far from a critical rating. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit reference supplied, so this is no public exploit identified at time of analysis. One internal tension is worth flagging: the vendor vector encodes UI:N, yet the description explicitly states the dangerous outcome (JavaScript execution) only occurs 'when an authenticated user tries to download the uploaded file' - that is a victim interaction and an authenticated victim, which the UI:N/PR:N vector does not capture; verify the intended attack model with ARKETEAM/CERT-PL. Net: a real but low-urgency, low-prevalence web-application flaw, not a high-CVSS-but-overstated issue and not a widespread-exploitation threat.

An attacker with adjacent-network reach to the Protectel module uploads a file containing embedded JavaScript into the shared temporary folder, overwriting an existing file that legitimate users expect. When an authenticated user later downloads that file, the embedded script executes in the context of their session/browser. No public exploit code is referenced, and the payload only runs on the victim's download action, so success depends on a user retrieving the attacker-planted file.