Integrated Management Platform EUVD-2026-12355

Technologies Integrated Management Platform 7.17.0 with /SetWebpagePic.jsp endpoint accessible. No authentication required. Remote unauthenticated attacker can exploit default installation without special configuration.

This vulnerability presents moderate-to-high real-world risk based on multiple factors. The CVSS 3.1 score of 7.3 indicates high severity with network-based attack vector (AV:N), low complexity (AC:L), and no privileges required (PR:N), making it easily exploitable. The existence of a public POC (E:P in CVSS) significantly increases risk as it lowers the barrier for exploitation. However, the absence from CISA KEV suggests it's not being actively exploited in the wild at scale. The low impact ratings (C:L/I:L/A:L) indicate limited direct damage potential, though file upload vulnerabilities often serve as initial access vectors for more severe attacks. The vendor's non-response to disclosure attempts is concerning as it suggests no patch is forthcoming.

An attacker can remotely exploit this vulnerability without any authentication by sending a specially crafted HTTP request to /SetWebpagePic.jsp with manipulated targetPath and Suffix parameters to upload malicious files (such as web shells) to arbitrary locations on the server. The public POC available at https://my.feishu.cn/docx/EA9HdaXaQo80yTxKdw0c3UDmnmD demonstrates the attack technique. Once a web shell is uploaded, the attacker could execute arbitrary commands, access sensitive data, or use the compromised server as a pivot point for further attacks on the internal network.