CVE-2025-9099 MEDIUM

CVE-2025-9099: Acrel Environmental Monitoring Cloud Platform UploadNewsImg unrestricted upload

Vendor Acrel
Product Environmental Monitoring Cloud Platform
Weakness CWE-434 · Unrestricted file upload
Published August 18, 2025
Last update August 18, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was identified in Acrel Environmental Monitoring Cloud Platform up to 20250804. This affects an unknown part of the file /NewsManage/UploadNewsImg. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

August 18, 2025 CVE published
August 18, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-66074 WordPress WP Webhooks plugin <= 3.3.8 - Arbitrary File Upload vulnerability CVE-2023-3626 Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System UpLoadFloodPlanFile UpLoadFloodPlanFile.ashx unrestricted upload CVE-2025-9942 CodeAstro Real Estate Management System submitproperty.php unrestricted upload CVE-2013-10032 GetSimple CMS 3.2.1 Authenticated RCE via Arbitrary PHP File Upload CVE-2019-25616 AnMing MP3 CD Burner 2.0 Local Denial of Service