EUVD-2026-53674
GHSA-qhv6-j2j7-vj9q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable upload of arbitrary files to a web server enables web shell execution, changing scope and yielding full C/I/A compromise.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dispatch/userinfo/upload. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Unauthenticated file upload in Rongzhitong Visual Integrated Command and Dispatch Platform (versions through 20260617) allows remote attackers to upload arbitrary files - including web shells - to the server via the /dm/dispatch/userinfo/upload endpoint without any authentication. The 'Authentication Bypass' tag confirms that access controls on this endpoint are entirely absent, not merely weak. A public proof-of-concept exploit exists and is circulating, and the vendor has not responded to disclosure contact, meaning no patch is forthcoming. No public exploit identified as confirmed actively exploited (CISA KEV), but PoC availability and zero remediation response substantially raise real-world risk.
Technical ContextAI
The affected endpoint /dm/dispatch/userinfo/upload accepts multipart file uploads via the 'File' argument and imposes no restriction on file type, extension, or content. The root cause is classified as CWE-284 (Improper Access Control) rather than CWE-434 (Unrestricted Upload), indicating the primary flaw is that the endpoint is accessible without authentication - the upload restriction failure is a consequence of the access control bypass. The platform is a Visual Integrated Command and Dispatch system (visual unified command and scheduling platform), likely targeting public safety, emergency response, or enterprise operations centers, primarily in the Chinese market. No CPE string was provided in the input data, so exact platform versioning is derived solely from the description's cutoff of build 20260617.
RemediationAI
No vendor-released patch identified at time of analysis. The vendor did not respond to disclosure contact, and no advisory or fixed version has been published. As an immediate compensating control, restrict external and internal network access to the /dm/dispatch/userinfo/upload endpoint at the firewall or reverse proxy layer - blocking or rate-limiting POST requests to this path will eliminate remote exploitation while the application remains running; trade-off is that any legitimate upload functionality is disabled. If a WAF is in place, add a rule to block multipart uploads to this specific endpoint. Additionally, review the web server's document root to identify whether previously uploaded files are already present and inspect for web shells (common extensions: .php, .jsp, .asp, .aspx). If the platform cannot be taken offline, consider network segmentation to restrict access to internal administrative networks only. Organizations requiring this functionality should engage the vendor directly or evaluate replacement products, as the vendor's non-responsiveness to disclosure suggests limited security maturity.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today