PT-2025-37302 · Newtype Infortech · Nup Portal

Zw Cai · Published 2025-09-12 · Updated 2025-09-12 · CVE-2025-10267

Positive Technologies · (AI Summary)

CVSS v3.1

5.3

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: NUP Portal (affected versions not specified)

Description: The NUP Portal application developed by NewType Infortech suffers from a missing authentication issue. This allows unauthenticated remote attackers to directly upload files to the system. Successful exploitation, bypassing file extension restrictions, could enable attackers to upload and execute webshells on the server.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-10267

Affected Products

Nup Portal

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-10267 · Security Note
• https://twcert.org.tw/tw/cp-132-10377-89750-1.html · Note
• https://twcert.org.tw/en/cp-139-10378-4fd0d-2.html · Note
• https://twitter.com/VulmonFeeds/status/1966467560091628008 · Twitter Post
• https://t.me/cveNotify/135222 · Telegram Post
• https://twitter.com/CVEnew/status/1966454316039876763 · Twitter Post
• https://t.me/CVEtracker/32364 · Telegram Post