Youxun Electronic Equipment (Shanghai) Co. · Ac Centralized Management Platform · CVE-2023-34855
**Name of the Vulnerable Software and Affected Versions**
Youxun Electronic Equipment (Shanghai) Co., Ltd AC Centralized Management Platform version 1.02.040
**Description**
A Cross Site Scripting (XSS) issue allows attackers to execute arbitrary code via uploading a crafted HTML file to the "upfile.cgi" API endpoint.
**Recommendations**
For version 1.02.040, consider disabling the file upload functionality to the "upfile.cgi" endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using this interface until the issue is resolved.