Unrestricted File Upload in Specto CM Enables Remote Code Execution

Publication date: 2025-12-24

Last updated on: 2026-06-06

Assigner: Computer Emergency Response Team of the Republic of Turkey

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Remote Code Inclusion. This issue affects Specto CM: before 17032025.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-24

Last Modified

2026-06-06

Generated

2026-07-06

AI Q&A

2025-12-24

EPSS Evaluated

2026-07-05

NVD

CVE-2025-2155

EUVD

EUVD-2025-205285

Affected Vendors & Products

Vendor	Product	Version / Range
echo_call_center_services_trade_and_industry_inc	specto_cm	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability is an Unrestricted Upload of File with Dangerous Type in Echo Call Center Services Trade and Industry Inc. Specto CM. It allows an attacker to upload files that can lead to Remote Code Inclusion, meaning the attacker can execute arbitrary code on the affected system remotely.

Impact Analysis

The vulnerability can lead to severe impacts including remote code execution, which can compromise the confidentiality, integrity, and availability of the affected system. An attacker could take control of the system, access sensitive data, or disrupt services.

Hi! I’m here to help you understand CVE-2025-2155. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70