EUVD-2026-54309
GHSA-r6gv-mg3v-cx2f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Smart Park instance
-
DeliveryCraft malicious upload request
-
ExploitUpload web shell via unvalidated module
-
ExecutionRequest uploaded file URL
-
ImpactExecute arbitrary code as web server
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The specific prerequisite is that the target exposes the product's file upload module, which accepts uploads without validating file type/extension/content and stores them in a web-executable location - this is the default flaw, not a special configuration. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and low complexity are required: remote unauthenticated exploitation against a reachable instance of ICS-Park Smart Park Management System v2.0. The main limiting factor is exposure and prevalence - the product must be network-reachable and it is a niche application with a small deployment base, which is why observed exploitation (EPSS 0.26%) is low despite the trivial technical barrier. Verify the impact class independently, as one referenced PoC artifact is labeled as XSS rather than RCE. |
| Impact | Signals are mixed but lean toward genuine priority for anyone running the product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes trivially reachable, unauthenticated, no-interaction network exploitation with total impact, and SSVC corroborates this (Automatable: yes, Technical Impact: total, Exploitation: poc). Publicly available exploit code lowers the barrier further. The countervailing signal is EPSS at just 0.26% (17th percentile), which typically reflects a niche product with a small internet-exposed footprint rather than a defanged vulnerability - low EPSS here indicates limited breadth of targets, not low per-instance severity. Note a data-quality caveat: the primary 'github-poc' reference is labeled 'xsspoc' (suggesting XSS) while the CVE is classed RCE/File Upload, and the NVD reference path points at a sibling ID (CVE-2026-67687); the technical impact class should be verified against the actual PoC. Bottom line: for the small population that runs this system, treat as high priority; the low EPSS reflects rarity, not safety. |
| Exploit ScenarioDerived | A remote attacker locates an internet-exposed ICS-Park Smart Park instance and, without any credentials, sends a crafted upload request to the file upload module containing a server-side web shell. Because uploads are neither type-validated nor stored in a non-executable location, the attacker then requests the uploaded file's URL to execute commands as the web server user. Public PoC code exists, lowering the skill required to reproduce this. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 07, 2026
Unrestricted file upload in ICS-Park Smart Park Management System v2.0 lets a remote attacker upload and execute arbitrary code through the product's file upload module, yielding full server compromise (CVSS 9.8). Public exploit code exists and the flaw is automatable with total technical impact per CISA SSVC, though the EPSS probability remains low at 0.26% (17th percentile), indicating limited observed exploitation activity so far. No CISA KEV listing means no confirmed active exploitation at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis, and no fixed version is published in NVD or EUVD, so remediation must rely on compensating controls. Restrict network reachability of the application - place it behind a VPN or IP allowlist so the upload endpoint is not internet-exposed. At a reverse proxy or WAF, block or filter POST requests to the file upload module and deny requests for executable/script file types (e.g. .php, .jsp, .asp, .aspx) in upload paths; the trade-off is that legitimate document uploads of those types will break. Configure the web server so the upload storage directory is non-executable (serve as static content only, with script handlers disabled) - this neutralizes web-shell execution but does not stop the upload itself. Monitor the upload directory for newly written server-side scripts and enforce authentication in front of the module. Track the vendor and the NVD page (https://nvd.nist.gov/vuln/detail/CVE-2026-67688) for an official fixed release and apply it once available.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-434 (Unrestricted Upload of File with Dangerous Type) defect: the file upload module fails to validate the type, extension, or content of uploaded files, allowing a server-side executable (e.g. a web shell in the application's server-side language) to be written into a web-accessible directory and then invoked. ICS-Park Smart Park Management System is a smart-park / campus facility management web application; because the product is delivered as a network-facing web application, an uploaded script executes in the web server's runtime context, translating a file-write primitive into remote code execution. Precise underlying technology stack, upload endpoint path, and storage location are not disclosed in the available intelligence.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable upload endpoint with no interaction and low complexity yields RCE, so AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
ICS-Park Smart Park Management System v2.0 contains a critical remote code execution vulnerability (CVE-2026-67688, CVSS 9.8) that allows attackers to upload and execute arbitrary code through the file upload module, resulting in complete server compromise and potential disruption of parking operations, payment processing, and customer data exposure. Publicly available exploit code exists for this flaw, and no vendor patch is currently available, requiring immediate containment to prevent active exploitation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable file upload functionality entirely if operationally feasible, or restrict to authenticated administrative users with multi-factor authentication; (2) Deploy WAF rules to detect and block file upload and code execution patterns; (3) Implement strict file type validation and execution restrictions on uploaded content; (4) Segment ICS-Park systems onto isolated network subnets with egress filtering; (5) Deploy endpoint detection and response (EDR) tools on servers hosting v2.0 to detect exploitation attempts; (6) Maintain comprehensive logging of file operations, authentication events, and system execution for forensic review.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB