EUVD-2025-201608Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible web API endpoint; PR:L reflects required low-privilege or path-knowledge access; limited C/I/A impact from file write without confirmed RCE chain.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A flaw has been found in Verysync 微力同步 up to 2.21.3. This impacts an unknown function of the file /rest/f/api/resources/f96956469e7be39d/tmp/text.txt?override=false of the component Web Administration Module. Executing manipulation can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Unrestricted file upload via the Web Administration Module of Verysync (微力同步) up to version 2.21.3 allows a low-privileged remote attacker to upload arbitrary files to the server through a specific API endpoint. The affected endpoint /rest/f/api/resources/f96956469e7be39d/tmp/text.txt?override=false lacks adequate access control enforcement, enabling file placement on the target system without proper authorization validation. A public proof-of-concept exploit has been published; no vendor patch or response has been confirmed as of time of analysis.
Technical ContextAI
Verysync (微力同步) is a proprietary P2P file synchronization application developed for the Chinese market, functionally analogous to BitTorrent Sync/Resilio Sync. The vulnerability resides in its embedded Web Administration Module - a local HTTP service that exposes a REST API for managing synchronization resources. The affected endpoint accepts PUT or POST requests to write file content without enforcing appropriate authorization checks, constituting CWE-284 (Improper Access Control). The URL structure includes what appears to be a static or predictable resource hash (f96956469e7be39d), which may function as a path-guessing or authentication-bypass vector rather than a proper access control token, explaining the concurrent 'Authentication Bypass' tag. CPE cpe:2.3:a:verysync:verysync:*:*:*:*:*:*:*:* covers versions through 2.21.3.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to coordinated disclosure. The primary compensating control is to restrict network access to the Verysync Web Administration Module port to localhost (127.0.0.1) only, preventing remote exploitation entirely - this is the most effective mitigation given the absence of a patch. If remote web admin access is operationally required, place the service behind a VPN or firewall ACL restricting access to trusted IP ranges. Deploying a reverse proxy with authentication enforcement in front of the Verysync web admin port can add an authentication layer that the application itself fails to enforce. Organizations relying on Verysync for sensitive data synchronization should evaluate migration to an actively-maintained alternative given the absence of vendor response. The published POC at https://github.com/jjjjj-zr/jjjjjzr/issues/10 should be reviewed to understand the exact upload mechanism and tailor detection rules accordingly.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today