PT-2025-42219 · Smartbi · Smartbi

Published 2025-10-15 · Updated 2025-10-15 · CVE-2023-7305

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SmartBI versions 8 through 10

Description SmartBI versions 8, 9, and 10 have an unrestricted file upload issue in the RMIServlet request handling logic. Attackers can send crafted requests to perform sensitive operations or execute code on the host. The Rondo botnet has been observed targeting this issue.

Recommendations Update to a version released in July 2023 or later.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-7305

Affected Products

Smartbi

References · 10

• 🔥 https://jeyiuwai.pages.dev/posts/1day-%E8%B7%9F%E8%B8%AAsmartbi-rmiservlet-%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E · Exploit
• https://smartbi.com.cn/patchinfo · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-7305 · Security Note
• https://twitter.com/CveFindCom/status/1978282059731779691 · Twitter Post
• https://avd.aliyun.com/detail?id=AVD-2023-1673292 · Note
• https://twitter.com/VulmonFeeds/status/1978351026441781458 · Twitter Post
• https://twitter.com/CVEnew/status/1978562101980406136 · Twitter Post
• https://t.me/cveNotify/138777 · Telegram Post
• https://vulncheck.com/advisories/smartbi-rmiservlet-unrestricted-file-upload-rce · Note
• https://t.me/CVEtracker/34930 · Telegram Post