CVE-2026-3025
MEDIUMCVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionNVD
A flaw has been found in ShuoRen Smart Heating Integrated Management Platform 1.0.0. Affected by this vulnerability is an unknown functionality of the file /MP/Service/Webservice/ExampleNodeService.asmx. Executing a manipulation of the argument File can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Smart Heating Integrated Management Platform versions up to 1.0.0 is affected by improper access control (CVSS 7.3).
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all instances of Smart Heating Integrated Management Platform and document version numbers and network connectivity. Within 7 days: Implement network segmentation to restrict access to the platform from trusted administrative networks only; disable remote access if not operationally critical; apply multi-factor authentication on all user accounts. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today