PT-2025-34943 · Anyshare · Anyshare

Pokersec · Published 2025-08-27 · Updated 2025-08-28 · CVE-2025-34160

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: AnyShare (affected versions not specified)

Description: AnyShare contains a critical unauthenticated remote code execution issue in the ServiceAgent API exposed on port 10250. The /api/ServiceAgent/start service endpoint accepts user-supplied input via POST requests and does not properly sanitize command-like payloads. An attacker can inject shell syntax that is interpreted by the backend, enabling arbitrary command execution.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-34160

Affected Products

Anyshare

References · 10

• 🔥 https://cn-sec.com/archives/4320091.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34160 · Security Note
• https://aishutech.com/en/anyshare-family7 · Patch
• https://stack.chaitin.com/vuldb/detail/b4640952-9be9-4bfa-9d7f-a0be72b35e18 · Note
• https://aishu.cn/cn · Note
• https://twitter.com/CVEnew/status/1960822221275808084 · Twitter Post
• https://twitter.com/offseq/status/1960900397523947713 · Twitter Post
• https://twitter.com/UjlakiMarci/status/1960971554461794340 · Twitter Post
• https://t.me/CVEtracker/31082 · Telegram Post
• https://vulncheck.com/advisories/anyshare-serviceagent-api-unauthenticated-rce · Note