A vulnerability exists in the SetWebpagePic.jsp component of Technologies Integrated Management Platform (version 7.17.0). Manipulation of the targetPath and Suffix parameters allows an attacker to upload arbitrary files without restrictions. The uploaded content can include malicious scripts or binaries, giving the attacker the ability to potentially execute code on the server. Derived from the vendor description, this issue results in an unrestricted upload vector that is exploitable remotely.

The affected product is Technologies Integrated Management Platform, specifically version 7.17.0 as listed by the CNA. No additional affected versions are documented in the provided data.

The CVSS score of 6.9 indicates a medium severity, and the EPSS score of fewer than 1% suggests a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, implying it has not yet been observed in widespread attacks. Attack initiation is explicitly stated as possible remotely, and the presence of authentication bypass (CWE‑284) and unrestricted file upload (CWE‑434) weaknesses further support an attack path that could lead to remote code execution if an attacker succeeds in uploading executable content.