CVE-2014-125113
BaseFortify
Publication date: 2025-08-05
Last updated on: 2025-08-05
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dell | kace_k1000 | 5.0 |
| dell | kace_k1000 | 5.3 |
| dell | kace_k1000 | 5.5 |
| dell | kace_k1000 | 5.4 |
| dell | kace_k1000 | 5.1 |
| dell | kace_k1000 | 5.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an unrestricted file upload issue in Dell KACE K1000 System Management Appliance versions 5.0 to 5.3, 5.4 before 5.4.76849, and 5.5 before 5.5.90547. It occurs in the download_agent.php endpoint, allowing an attacker to upload arbitrary PHP files to a temporary web-accessible directory. These files can then be executed by the system through backend code that includes files from attacker-controlled paths.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can upload and execute arbitrary PHP code on the affected system without any privileges or user interaction. This can lead to full system compromise, unauthorized access, data theft, or disruption of services.