CVE-2025-15226

Critical

Published: 29 December 2025

Published

29 December 2025

Modified

31 December 2025

KEV Added

—

Patch

—

CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0051 39.5th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-15226 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Sun.Net Wmpro. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-15226 is an arbitrary file upload vulnerability in WMPro, a product developed by Sunnet. The flaw enables unauthenticated remote attackers to upload web shell backdoors and execute them, resulting in arbitrary code execution on the server. It is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its high impact on confidentiality, integrity, and availability.

Any unauthenticated attacker with network access can exploit this vulnerability without requiring privileges, user interaction, or complex conditions. Successful exploitation allows attackers to upload malicious files, execute web shells, and achieve full remote code execution on the server, potentially leading to complete system compromise, data theft, or further lateral movement.

Advisories from Taiwan CERT (TWCERT) provide details on the vulnerability at https://www.twcert.org.tw/en/cp-139-10603-67149-2.html and https://www.twcert.org.tw/tw/cp-132-10602-c1c69-1.html, which security practitioners should consult for recommended mitigations and patches.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-205558

Vulnerability details

WMPro developed by Sunnet has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

CWE(s): CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

The vulnerability allows unauthenticated remote exploitation of a public-facing web application (T1190) to upload and execute web shells (T1100), directly enabling arbitrary code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0