The vulnerability is an arbitrary file upload flaw that permits a privileged remote attacker to upload and execute web shells or backdoors, allowing arbitrary code execution on the server. The weakness is identified as CWE-434, which indicates that no validation of the file type or content is performed before allowing the upload. If exploited, the attacker can compromise confidentiality, integrity, and availability of the affected system.

CAYIN Technology’s CMS‑SE, CMS‑WS, and SMP series are affected. Versions below the vendor’s recommended updates (CMS‑WS 1.0.26198, CMS‑SE 11.0.26198, SMP 4.0.26198) are potentially vulnerable, though the exact versions are not enumerated in the advisory. Updating to the specified versions or newer removes the vulnerability.

The CVSS score of 8.6 classifies this flaw as high severity, and the KEV status is not listed, indicating no current known exploitation in the wild. A privileged remote attacker can exploit the upload endpoint, place a malicious script in the web root, and then invoke it for code execution. The lack of input validation and dependency on the upload feature make exploitation feasible if access is available.