CVE-2025-7917
Published: 21 July 2025
Summary
CVE-2025-7917 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Org (inferred from references). Its CVSS base score is 8.6 (High).
Operationally, ranked in the top 20.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
WinMatrix3 Web package developed by Simopro Technology contains an arbitrary file upload vulnerability tracked as CVE-2025-7917. The flaw, classified under CWE-434, permits unauthenticated remote upload of arbitrary files when the attacker already holds administrator credentials, directly enabling placement of executable content on the server.
An attacker with administrator privileges can exploit the issue over the network to upload and execute web shell backdoors, resulting in arbitrary code execution with high impact to confidentiality, integrity, and availability on the affected server. The CVSS 4.0 score of 8.6 reflects the network attack vector, low attack complexity, and high-privilege requirement.
Official advisories published by Taiwan's CERT at the referenced URLs provide further details on the affected product versions and recommended remediation steps. The associated EPSS score remains low and unchanged at 0.0122, indicating no material increase in observed exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22060
Vulnerability details
WinMatrix3 Web package developed by Simopro Technology has an Arbitrary File Upload vulnerability, allowing remote attackers with administrator privileges to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.