Limatek System Inc.'s LimRAD NAC has an unrestricted file upload vulnerability that allows an attacker to upload files of dangerous types, resulting in remote code inclusion. The flaw permits the execution of malicious code on the NAC server, compromising confidentiality, integrity, and availability of the network access control system. Classified as CWE-434, the vulnerability carries a CVSS score of 9.8, indicating a critical security risk.

The affected vendor is Limatek System Inc. and the product is LimRAD NAC. Versions older than 5.5.7.3.9 are impacted. No other versions are listed.

The vulnerability is exploitable over the network by submitting a malicious file through the NAC’s upload interface. Although the EPSS score is not available, the high CVSS score and the remote nature of the attack suggest a significant likelihood of exploitation. The issue is not currently listed in CISA KEV, but the critical CVSS rating warrants immediate attention.