{"id":"CVE-2025-4556","state":"PUBLISHED","title":"ZONG YU Okcat Parking Management Platform - Arbitrary File Upload","description":"The web management interface of Okcat Parking Management Platform from ZONG YU has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.","publishedAt":"2025-05-12T02:11:56.864Z","updatedAt":"2025-05-12T17:49:41.498Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"twcert"},"assigner":"twcert","products":["ZONG YU Okcat Parking Management Platform"],"affected":[{"vendor":"ZONG YU","product":"Okcat Parking Management Platform","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"}]}],"references":["https://www.twcert.org.tw/tw/cp-132-10110-114f0-1.html","https://www.twcert.org.tw/en/cp-139-10111-b78e6-2.html"],"weaknesses":["CWE-434"],"ingestedAt":"2026-10-29T20:09:23.771Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/4xxx/CVE-2025-4556.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-4556","state":"PUBLISHED","datePublished":"2025-05-12T02:11:56.864Z","dateUpdated":"2025-05-12T17:49:41.498Z","assignerShortName":"twcert","assignerOrgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateReserved":"2025-05-12T01:49:27.948Z"},"containers":{"cna":{"title":"ZONG YU Okcat Parking Management Platform - Arbitrary File Upload","descriptions":[{"lang":"en","value":"The web management interface of Okcat Parking Management Platform from ZONG YU has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server."}],"affected":[{"vendor":"ZONG YU","product":"Okcat Parking Management Platform","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"}]}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-10110-114f0-1.html","tags":["third-party-advisory"]},{"url":"https://www.twcert.org.tw/en/cp-139-10111-b78e6-2.html","tags":["third-party-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","description":"CWE-434 Unrestricted Upload of File with Dangerous Type","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"twcert","orgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateUpdated":"2025-05-12T02:11:56.864Z"},"datePublic":"2025-05-12T02:09:00.000Z","impacts":[{"capecId":"CAPEC-650","descriptions":[{"lang":"en","value":"CAPEC-650 Upload a Web Shell to a Web Server"}]}],"source":{"advisory":"TVN-202505008","discovery":"EXTERNAL"},"tags":["unsupported-when-assigned"],"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The affected product is no longer maintained. It is recommended to evaluate and adopt alternative products."}],"value":"The affected product is no longer maintained. It is recommended to evaluate and adopt alternative products."}],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-12T17:49:17.405210Z","id":"CVE-2025-4556","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-12T17:49:41.498Z"}}]}}}