Data Management Center EUVD-2026-63792

No special conditions are required for exploitation beyond network connectivity to the upload API endpoint. The CVSS vector PR:N/AV:N/AC:L/AT:N/UI:N confirms unauthenticated remote exploitation against default configurations of Data Management Center v8.3.0-v8.5.1. No specific feature toggle, non-default configuration, or privilege escalation step is required to reach the vulnerable endpoint. Exploitation is limited by: (1) network reachability - if the management center is deployed on a non-internet-facing segment with strict ACLs, remote exploitation from untrusted networks is blocked; (2) post-upload impact depends on whether the upload directory is web-accessible and whether the server executes uploaded script types, which may vary by deployment configuration.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H) represents a high-priority exploit scenario: no authentication, no complexity, no user interaction, network-reachable. The corresponding CVSS 3.1 base score of 8.8 aligns with this assessment. No EPSS data was provided in the intelligence sources, so exploitation probability cannot be quantified numerically. The vulnerability is not currently listed in CISA KEV, and no public proof-of-concept has been identified. However, the attack surface is straightforward - CWE-306 flaws in HTTP APIs require only a well-formed POST request - meaning exploitation is trivially automatable once the endpoint is located. The primary limiting factor on real-world impact is deployment footprint: Datiphy is a niche vendor with unclear market penetration, reducing the overall blast radius compared to a similar flaw in a ubiquitous product. Organizations running Data Management Center v8.3.0-v8.5.1 with internet-facing or untrusted-network exposure should treat this as a critical priority regardless of KEV absence.

An attacker with network-level access to the Data Management Center instance sends a crafted multipart/form-data HTTP POST request directly to the unauthenticated upload API endpoint, supplying an arbitrary file such as a web shell. The server accepts the file without challenging for credentials and writes it to the configured upload directory. If that directory is web-accessible and the server executes the uploaded file type, the attacker can subsequently issue HTTP requests to the uploaded file to achieve remote command execution under the web server's process identity.