EUVD-2026-66342
GHSA-6c9p-6j83-qg5r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable upload endpoint but PR:H required; scope unchanged as no lateral system impact described; full C/I/A on the server.
Primary rating from Vendor (twcert).
CVSS VectorVendor: twcert
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shells backdoors, thereby enabling arbitrary code execution on the server.
AnalysisAI
Arbitrary file upload leading to remote code execution affects CAYIN Technology's CMS-WS, CMS-SE, and SMP series digital signage management platforms. Privileged remote attackers can upload web shells through the product's file upload functionality and then execute arbitrary commands on the underlying server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold high-privileged credentials (PR:H per CVSS 4.0 vector) on one of the affected CAYIN CMS platforms - unauthenticated access is not sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.6 reflects severe potential impact (VC:H/VI:H/VA:H) but is tempered by a critical prerequisite: PR:H (high privileges required), meaning the attacker must already hold an administrative or highly privileged account on the CMS platform before exploitation is possible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or compromised a privileged CAYIN CMS administrator account - through credential theft, phishing, or reuse - authenticates to the web management interface and submits a crafted file (e.g., a PHP or ASP web shell) via the file upload feature. The server accepts and stores the file without type validation, and the attacker then browses to the uploaded shell's URL to issue arbitrary OS commands, gaining full control of the server. … |
| Remediation | Consult the TWCERT advisories at https://www.twcert.org.tw/tw/cp-132-11129-4a040-1.html and https://www.twcert.org.tw/en/cp-139-11135-189f7-2.html for vendor-released patch guidance; the EUVD-sourced version caps (CMS-WS ≤1.0.25336, CMS-SE ≤11.0.25336, SMP ≤4.0.25336) identify the vulnerable range, but an exact fixed release version was not confirmed in available data - contact CAYIN Technology directly to obtain the patched build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of all CAYIN CMS-WS, CMS-SE, and SMP instances across your infrastructure and document their current versions, build numbers, and network location. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cayin Cms Ws
View allSame technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today