CVE-2026-3025
Last modified
CVE-2026-3025 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A flaw has been found in ShuoRen Smart Heating Integrated Management Platform 1.0.0. Affected by this vulnerability is an unknown functionality of the file /MP/Service/Webservice/ExampleNodeService.asmx. EPSS estimates a 0.38% chance of exploitation in the next 30 days.
Description
A flaw has been found in ShuoRen Smart Heating Integrated Management Platform 1.0.0. Affected by this vulnerability is an unknown functionality of the file /MP/Service/Webservice/ExampleNodeService.asmx. Executing a manipulation of the argument File can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Shuoren | Smart Heating Integrated Management Platform | 1.0.0 |
References
- https://vuldb.com/?ctiid.347381Permissions Required, VDB Entry
- https://vuldb.com/?id.347381Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.756376Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-3025?
How severe is CVE-2026-3025?
How do I fix CVE-2026-3025?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-30240Budibase is a low code platform for creating internal tools,…8.1
- CVE-2026-30241Mercurius is a GraphQL adapter for Fastify. Prior to version…8.2
- CVE-2026-30242Plane is an an open-source project management tool. Prior to…8.5
- CVE-2026-30244Plane is an an open-source project management tool. Prior to…7.5
- CVE-2026-30246Fiber is a web framework for Go. In github.com/gofiber/fiber…6.5
- CVE-2026-30247WeKnora is an LLM-powered framework designed for deep docume…7.5
- CVE-2026-30251A reflected cross-site scripting (XSS) vulnerability in the …6.1
- CVE-2026-30252Multiple reflected cross-site scripting (XSS) vulnerabilitie…6.1
- CVE-2026-3026A vulnerability has been found in erzhongxmu JEEWMS 3.7. Aff…7.3
- CVE-2026-30266Insecure Permissions vulnerability in DeepCool DeepCreative …7.8
- CVE-2026-30269Improper access control in Doorman v0.1.0 and v1.0.2 allows …9.9
- CVE-2026-3027A vulnerability was found in erzhongxmu JEEWMS up to 3.7. Th…6.1
Are you affected by CVE-2026-3025?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST