Datiphy Data Management Center Auth and Injection Flaws

OS command injection in the Datiphy Data Management Center API endpoint (versions v8.3.0 through v8.5.1) lets an authenticated administrator run arbitrary operating-system commands as root, escalating application-level admin rights into full host compromise. Rated CVSS 4.0 9.4 (Critical) and reported by ZUSO ART, the flaw yields high confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Arbitrary file write in Datiphy Data Management Center versions 8.3.0 through 8.5.1 lets a remote, unauthenticated attacker place files anywhere on the host by abusing the upload API endpoint, which fails to constrain attacker-supplied file names or paths. Because uploaded content can escape the intended upload directory using relative or absolute path sequences, an attacker can overwrite critical files or drop executable payloads, threatening integrity and availability of the appliance. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 and lack of any authentication or user-interaction requirement make this straightforward to weaponize.

Administrative account takeover in Datiphy Data Management Center (v8.3.0 through v8.5.1) lets a remote attacker log into the management platform using shipped default administrator credentials, granting full control over the database-activity-monitoring console. Rated CVSS 4.0 9.3 (critical) with a fully network-reachable, unauthenticated vector, though no public exploit identified at time of analysis and no CISA KEV listing exists. Because the console governs database auditing and policy, compromise undermines the very security telemetry it is meant to provide.

Unauthenticated arbitrary file upload in Datiphy Data Management Center v8.3.0 through v8.5.1 exposes the upload API endpoint without any authentication enforcement, permitting remote attackers to write arbitrary files directly to the server's configured upload directory. The root cause is CWE-306 (Missing Authentication for Critical Function), confirmed by ZUSO ART and registered as ENISA EUVD-2026-63792. The CVSS 4.0 vector scores network-accessible, zero-complexity, unauthenticated exploitation with high integrity and availability impact; no public exploit or CISA KEV listing has been identified at time of analysis.