CVE-2025-11908

Name of the Vulnerable Software and Affected Versions Shenzhen Ruiming Technology Streamax Crocus version 1.3.40

Description A security flaw exists in the Streamax Crocus software. The issue involves unrestricted file upload through manipulation of the File argument in the uploadFile function, accessible via the /FileDir.do?Action=Upload endpoint. This allows for remote exploitation. The exploit has been publicly released. The vendor was contacted but did not respond.

Recommendations Apply a fix for Streamax Crocus version 1.3.40 to address the unrestricted file upload issue. As a temporary workaround, restrict access to the /FileDir.do?Action=Upload endpoint. Avoid uploading files to the affected endpoint until a fix is available.