High severity · published Aug 30, 2024
CVE-2024-8330
Gether Technology 6SHR System - Unrestricted File Upload
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
6SHR system from Gether Technology does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload web shell scripts and use them to execute arbitrary system commands on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
6S
6SHR System · Gether Technology
0 · source: vendor, NVD
6S
6shr · Gethertechnology
0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8330
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8330
Vendor Advisory
https://www.twcert.org.tw/en/cp-139-8035-53926-2.html
Vendor Advisory
https://www.twcert.org.tw/tw/cp-132-8031-a2f21-1.html
More from 6SHR System
8.8
CVE-2024-8329
Gether Technology 6SHR System - SQL Injection