EUVD-2026-84184
GHSA-64j7-pv8p-xprg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid webUI credentials
-
DeliveryAccess upgrade package upload feature
-
ExploitUpload server-side executable file
-
ExecutionFile stored in web-accessible executable path
-
PersistRequest uploaded file over HTTP
-
ImpactAchieve remote code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires authenticated access to the Jazzware RT1000 Edge webUI (PR:L) - specifically the ability to reach the upgrade-package upload functionality - so an attacker must first obtain or possess valid webUI credentials. Given that access, no further special configuration is needed: the flaw exists in default behavior where uploaded files are placed in a web-accessible, executable directory and can then be invoked directly over HTTP without additional authentication. The main limiting factors are the credential requirement to reach the upload feature and the product's narrow, niche deployment; there is no user-interaction requirement (UI:N) and the network vector (AV:N) means any authenticated user with webUI reachability can attempt it. |
| Impact | This is a genuinely high-impact flaw whose real-world urgency is tempered by low exploitation-probability signals and an obscure target. The CVSS 3.1 base of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is credible: an authenticated attacker uploads a server-side executable that lands in a web-accessible, executable directory and is then invoked over plain HTTP, yielding full RCE (C:H/I:H/A:H). Against that, EPSS is only 0.24% (16th percentile), the CVE is NOT on CISA KEV, and no weaponized exploit code is published - status is no public exploit identified at time of analysis, though a detailed third-party technical write-up (lcybersec Notion page) exists and could accelerate exploit development. The single real gate is PR:L: the attacker must first hold valid webUI credentials, so this is not a fully unauthenticated internet-worm scenario; combined with the product's tiny deployment footprint, this reads as a targeted-opportunity issue rather than a mass-exploitation priority. No conflicting signals in the CVSS/description (both indicate network-reachable, authenticated, high technical impact), but the CPE/vendor/version metadata is entirely 'n/a', so affected-version scoping cannot be verified from NVD. |
| Exploit ScenarioDerived | An attacker with valid (possibly low-privilege) credentials to the Jazzware RT1000 Edge webUI navigates to the upgrade-package upload feature and uploads a malicious server-side executable instead of a legitimate firmware/upgrade package. Because the file is written to a web-accessible, executable location, the attacker then simply requests it over HTTP (no auth needed at that step), triggering server-side execution and achieving remote code execution. No public exploit code is identified, but a detailed technical advisory describing the flaw is publicly available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Authenticated remote code execution affects the Jazzware RT1000 Edge webUI version 20.0.1, where the upgrade-package upload feature accepts server-side executable files and stores them in a web-accessible, executable directory that can be invoked directly over HTTP without authentication. An attacker who already holds valid webUI credentials (CVSS vector PR:L) can reach the upload function, place a malicious executable, and trigger it remotely, yielding full compromise of confidentiality, integrity, and availability (CVSS 8.8). Exploitation status: no public exploit identified at time of analysis; the CVE is not in CISA KEV, and EPSS is low at 0.24% (16th percentile), reflecting the niche target and the credential prerequisite rather than weak impact.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must currently rely on compensating controls. First, restrict access to the webUI upgrade-package upload endpoint to a trusted management network or bastion, since the flaw still requires valid credentials to reach - this reduces the pool of attackers who can attempt it but does not fix the upload logic and leaves any credential compromise fully exploitable. Second, change the web server configuration so the upload/staging directory is not served over HTTP and has execution disabled (e.g., remove execute permissions, deny script interpreters, or map the path to a non-executable handler); the trade-off is that the legitimate upgrade mechanism may break until re-pointed to a safe path. Third, enforce strict server-side validation on upgrade packages - allowlist expected package extensions and MIME types, verify cryptographic signatures or checksums if the platform supports them, and reject anything executable. Fourth, run the webUI service under a least-privileged OS account with write access confined to a non-served directory to limit post-upload impact. Monitor web-accessible directories for unexpected dropped files and audit webUI authentication events for anomalous logins. Track the references at https://nvd.nist.gov/vuln/detail/CVE-2026-88738 and https://lcybersec.notion.site/CVE-2026-88738-Unrestricted-file-upload-vulnerability-resulting-in-remote-code-execution-in-Jazzwa-3e06e8f484b5809e9eb3ffa705995d22 for a vendor fix, and replace these workarounds with the official patch as soon as one is published.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is an unrestricted file upload (CWE-434) in the Jazzware RT1000 Edge webUI's upgrade-package upload handler. The application fails to validate the type, extension, or content of files submitted through this administrative workflow, and additionally places them into a directory that the underlying web server both serves and treats as executable, so a stored file becomes an addressable HTTP resource. This creates a classic upload-to-RCE chain: write access to the upload endpoint converts directly into remote code execution because no second barrier (authentication on the uploaded resource, execution-disabled directory, or filename/content allowlisting) exists downstream. The vulnerability is reachable only after authenticating to the webUI (the assessed vector carries PR:L), meaning the upload endpoint itself is credential-gated while the payload it drops is not. Notably, the CPE string supplied by the feed is a placeholder (n/a:n/a) and the EUVD affected-version field is likewise 'n/a n/a', indicating the affected product has not been formally enumerated in CPE/versioned form; the concrete affected build is Jazzware RT1000 Edge webUI v20.0.1 as stated in the description. ENISA tracks it as EUVD-2026-84184.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable webUI upload requires valid credentials (PR:L) but no user interaction; resulting arbitrary code execution yields full high confidentiality, integrity, and availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgrade package upload functionality. An authenticated attacker can upload a server-side executable file. The uploaded file is stored in a web-accessible executable location and can be accessed directly over HTTP without authentication, resulting in remote code execution.
Executive ViewAI
Jazzware RT1000 Edge appliances running webUI version 20.0.1 contain an authenticated remote code execution flaw that allows a user with valid webUI credentials to upload and execute arbitrary server-side code, resulting in full loss of confidentiality, integrity, and availability on the affected device. Because these edge appliances typically sit at the boundary of operational networks, a compromised unit could serve as a foothold for lateral movement into industrial or facility environments. Leadership should treat this as a high-priority exposure for any business unit relying on RT1000 Edge devices for edge connectivity, while noting that exploitation requires an existing credential and no public exploit or active exploitation has been identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict webUI management access to a trusted administrative network or VPN and block direct HTTP reachability from untrusted segments; rotate and strictly limit webUI credentials, enforcing least privilege; disable or block the upgrade-package upload feature where operationally feasible; deploy file-integrity monitoring and alerting on executable files written to web-accessible directories; and monitor appliance logs for anomalous upload or execution activity. Authenticated exploitation (CVSS PR:L) means credential hygiene and account governance are the primary near-term controls.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB