Login Request a demo
High severity · published Oct 17, 2025
CVE-2025-11908
Shenzhen Ruiming Technology Streamax Crocus FileDir.do uploadFile unrestricted upload
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
A security flaw has been discovered in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The affected element is the function uploadFile of the file /FileDir.do?Action=Upload. Performing manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Streamax Crocus · Shenzhen Ruiming Technology
1.3.40 · source: vendor, NVD
Affected product
SC
Streamax Crocus
Shenzhen Ruiming Technology
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11908
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11908
Exploit
https://github.com/FightingLzn9/vul/blob/main/%E6%B7%B1%E5%9C%B3%E5%B8%82%E9%94%90%E6%98%8E%E6%8A%80%E6%9C%AF%E8%82%A1%E4%BB%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8Crocus%E7%B3%BB%E7%BB%9F.md
Permissions Required
https://vuldb.com/?ctiid.328918
Third Party Advisory
https://vuldb.com/?id.328918
Third Party Advisory
https://vuldb.com/?submit.671391
More from Streamax Crocus
8.8
CVE-2025-11912
Shenzhen Ruiming Technology Streamax Crocus DeviceState.do Query sql injection
8.8
CVE-2025-11911
Shenzhen Ruiming Technology Streamax Crocus DeviceFault.do Query sql injection
8.8
CVE-2025-11910
Shenzhen Ruiming Technology Streamax Crocus MemoryState.do query sql injection
8.8
CVE-2025-11909
Shenzhen Ruiming Technology Streamax Crocus RepairRecord.do queryLast sql injection
7.5
CVE-2025-11914
Shenzhen Ruiming Technology Streamax Crocus DeviceFileReport.do download path traversal