Description
A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dispatch/userinfo/upload. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-05
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows manipulation of the File argument on the /dm/dispatch/userinfo/upload endpoint, resulting in unrestricted upload of arbitrary files to the server. The upload function is exposed remotely, so an attacker can deliver files without authenticating.

Affected Systems

Rongzhitong’s Visual Integrated Command and Dispatch Platform up to 20260617 is vulnerable; newer releases may contain a fix but are not listed in the data.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate‑to‑high risk. Because the upload functionality is exposed remotely, the exploit can be performed from outside the network. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, yet publicly available exploits demonstrate a realistic attack window, especially given the lack of authentication or file‑type restrictions.

Generated by OpenCVE AI on August 6, 2026 at 00:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor‑released patch or upgrade to a fixed version.
  • If a patch is not available, limit the /dm/dispatch/userinfo/upload endpoint to authenticated users only and implement strict file‑type whitelisting and size limits.
  • Store uploaded files outside the web root and serve them through a protected gateway that validates their type and performs malware scanning before delivery.
  • Monitor upload logs for anomalous activity and investigate suspicious file names or extensions.

Generated by OpenCVE AI on August 6, 2026 at 00:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 05 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dispatch/userinfo/upload. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Rongzhitong Visual Integrated Command and Dispatch Platform upload unrestricted upload
First Time appeared Rongzhitong
Rongzhitong visual Integrated Command And Dispatch Platform
Weaknesses CWE-284
CWE-434
CPEs cpe:2.3:a:rongzhitong:visual_integrated_command_and_dispatch_platform:*:*:*:*:*:*:*:*
Vendors & Products Rongzhitong
Rongzhitong visual Integrated Command And Dispatch Platform
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Rongzhitong Visual Integrated Command And Dispatch Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-06T15:08:09.527Z

Reserved: 2026-08-05T15:54:00.832Z

Link: CVE-2026-18969

cve-icon Vulnrichment

Updated: 2026-08-06T15:08:00.108Z

cve-icon NVD

Status : Deferred

Published: 2026-08-06T00:16:52.870

Modified: 2026-08-12T21:00:37.147

Link: CVE-2026-18969

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-06T02:15:03Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-434

    Unrestricted Upload of File with Dangerous Type