PT-2025-33628 · Acrel · Environmental Monitoring Cloud Platform

Notion.So · Published 2025-08-18 · Updated 2025-08-18 · CVE-2025-9099

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Acrel Environmental Monitoring Cloud Platform versions prior to 20250805

Description: A vulnerability exists in Acrel Environmental Monitoring Cloud Platform up to version 20250804. The issue affects an unknown part of the /NewsManage/UploadNewsImg file. Manipulation of the File argument allows for unrestricted file uploads, and the attack can be initiated remotely. The exploit has been publicly disclosed and may be used. The vendor was contacted regarding this disclosure but did not respond.

Recommendations: Versions prior to 20250805 should be updated. As a temporary workaround, restrict access to the /NewsManage/UploadNewsImg file to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-9099

Affected Products

Environmental Monitoring Cloud Platform

References · 9

• 🔥 https://notion.so/upload-23e9bb66b0a58088a9b4fcaea56a857f?source=copy_link · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9099 · Security Note
• https://vuldb.com/?ctiid.320421 · Note
• https://vuldb.com/?submit.628090 · Note
• https://t.me/cveNotify/132609 · Telegram Post
• https://t.me/CVEtracker/30252 · Telegram Post
• https://twitter.com/CVEnew/status/1957278982555988050 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1957275364058657176 · Twitter Post
• https://vuldb.com/?id.320421 · Note