PT-2025-11589 · Unknown · Softdial Contact Center

Published 2025-03-18 · Updated 2025-10-21 · CVE-2025-2494

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sytel Ltd Softdial Contact Center versions all versions

Description This issue allows an attacker to upload files to the server via the '/softdial/phpconsole/upload.php' endpoint, which is protected by basic HTTP authentication. The files are uploaded to a directory exposed by the web application, which could result in code execution, giving the attacker full control over the server.

Recommendations As a temporary workaround, consider disabling access to the '/softdial/phpconsole/upload.php' endpoint until a patch is available. Restrict access to the directory where uploaded files are stored to minimize the risk of exploitation. Avoid using basic HTTP authentication for the '/softdial/phpconsole/upload.php' endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-2494

Affected Products

Softdial Contact Center

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-2494 · Security Note
• https://twitter.com/WolfgangSesin/status/1901985163648667702 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-softdial-contact-center · Note
• https://t.me/cvenotify/115132 · Telegram Post
• https://twitter.com/CveFindCom/status/1901959802114257313 · Twitter Post
• https://t.me/cvetracker/19361 · Telegram Post
• https://t.me/cveNotify/139609 · Telegram Post
• https://t.me/latest_high_impact_cve/1995 · Telegram Post
• https://twitter.com/cybercronai/status/1902084080734498974 · Twitter Post
• https://twitter.com/CVEnew/status/1901961078441193961 · Twitter Post
• https://t.me/cvedetector/20565 · Telegram Post