| Article No° | Product Name | Affected Version(s) |
|---|---|---|
| SmartEMS Web Application | < v3.3.6 |
A path traversal flaw in the SmartEMS upload handling allows authenticated users to direct upload data outside of the intended directory via the 'Upload-Key' header. In deployments where writable, code-interpreted paths are reachable, this may lead to remote code execution.
The upload endpoint insufficiently validates the 'Upload-Key' request header. By supplying path traversal sequences, an authenticated attacker can cause the server to create upload-related artifacts outside the intended storage location. In certain configurations this enables arbitrary file write and may be leveraged to achieve remote code execution.
An authenticated attacker with network access to the SmartEMS Web UI can write outside the intended upload directory, overwrite or place files in sensitive locations, escalate to remote code execution depending on filesystem permissions and execution context, and access or modify sensitive data.
Mitigation
Restrict access to the SmartEMS Web UI to trusted admin networks or VPN. Enforce strong credentials and rotate or revoke active tokens/sessions.
Remediation
Update SmartEMS to version 3.3.6 which fixes the issue.
CERT@VDE coordinated with Welotec GmbH