{"id":"CVE-2025-0645","state":"PUBLISHED","title":"Arbitrary File Upload in Narkom Communication Technologies' Pyxis Signage","description":"Unrestricted Upload of File with Dangerous Type vulnerability in Narkom Communication and Software Technologies Trade Ltd. Co. Pyxis Signage allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects Pyxis Signage: through 31012025.","publishedAt":"2025-11-20T13:33:38.885Z","updatedAt":"2026-06-06T07:17:06.965Z","severity":{"score":7.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"TR-CERT"},"assigner":"TR-CERT","products":["Narkom Communication and Software Technologies Trade Ltd. Co. Pyxis Signage"],"affected":[{"vendor":"Narkom Communication and Software Technologies Trade Ltd. Co.","product":"Pyxis Signage","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"31012025","versionType":"custom"}]}],"references":["https://www.usom.gov.tr/bildirim/tr-25-0404","https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0404"],"weaknesses":["CWE-434"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/0xxx/CVE-2025-0645.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-0645","state":"PUBLISHED","datePublished":"2025-11-20T13:33:38.885Z","dateUpdated":"2026-06-06T07:17:06.965Z","assignerShortName":"TR-CERT","assignerOrgId":"ca940d4e-fea4-4aa2-9a58-591a58b1ce21","dateReserved":"2025-01-22T13:58:50.750Z"},"containers":{"cna":{"title":"Arbitrary File Upload in Narkom Communication Technologies' Pyxis Signage","descriptions":[{"lang":"en","value":"Unrestricted Upload of File with Dangerous Type vulnerability in Narkom Communication and Software Technologies Trade Ltd. Co. Pyxis Signage allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects Pyxis Signage: through 31012025."}],"affected":[{"vendor":"Narkom Communication and Software Technologies Trade Ltd. Co.","product":"Pyxis Signage","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"31012025","versionType":"custom"}]}],"references":[{"url":"https://www.usom.gov.tr/bildirim/tr-25-0404","tags":["government-resource","broken-link"]},{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0404","tags":["government-resource"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"HIGH","baseScore":7.2,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","lang":"en","description":"CWE-434 Unrestricted Upload of File with Dangerous Type","type":"CWE"}]}],"providerMetadata":{"shortName":"TR-CERT","orgId":"ca940d4e-fea4-4aa2-9a58-591a58b1ce21","dateUpdated":"2026-06-06T07:17:06.965Z"},"datePublic":"2025-11-20T13:30:00.000Z","impacts":[{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}],"credits":[{"lang":"en","value":"Tunahan TEKEOĞLU","type":"finder"}],"source":{"defect":["TR-25-0404"],"advisory":"TR-25-0404","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-11-20T19:22:19.576518Z","id":"CVE-2025-0645","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-11-20T19:33:45.313Z"}}]}}}