CVE-2021-38613

Name of the Vulnerable Software and Affected Versions NASCENT RemKon Device Manager version 4.0.0.0

Description The issue concerns the assets/index.php Image Upload feature, which allows attackers to upload any code to the target system, resulting in remote code execution. The API endpoint /assets/index.php is involved, specifically with the Image Upload feature.

Recommendations For NASCENT RemKon Device Manager version 4.0.0.0, consider disabling the Image Upload feature in the assets/index.php file as a temporary workaround until a patch is available. Restrict access to the /assets/index.php endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.