CVE-2023-4739
Published: 03 September 2023
Summary
CVE-2023-4739 is a medium-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Byzoro Smart S85F Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A critical vulnerability exists in the Byzoro Smart S85F Management Platform up to 20230820 within the /sysmanage/updateos.php file. Unrestricted upload of files with dangerous types occurs through manipulation of the 1_file_upload argument, corresponding to CWE-434. The flaw can be reached remotely and carries a CVSS 3.1 score of 6.3.
An authenticated attacker with low privileges can send a crafted request to upload arbitrary files to the server. Successful exploitation grants limited control over confidentiality, integrity, and availability of the affected system. Public exploit code has been released, and the vendor did not respond to early disclosure notification.
EPSS for the CVE rose materially from a low baseline to a peak of 0.0583 on 2025-01-22 before receding, indicating that exploitation interest developed well after the original publication. No vendor advisories or patches are referenced in available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-54587
Vulnerability details
A vulnerability, which was classified as critical, has been found in Byzoro Smart S85F Management Platform up to 20230820. Affected by this issue is some unknown functionality of the file /sysmanage/updateos.php. The manipulation of the argument 1_file_upload leads to unrestricted…
more
upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238628. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.