Vulnerability Description
EIP Plus developed by Hundred Plus has an Arbitrary File Uplaod vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://www.twcert.org.tw/en/cp-139-10491-004b0-2.html
- https://www.twcert.org.tw/tw/cp-132-10490-2534b-1.html
- https://www.chtsecurity.com/news/20848f61-9db5-44fd-8574-c9d6a54e4010
FAQ
What is CVE-2025-12867?
CVE-2025-12867 is a vulnerability with a CVSS score of 7.2 (HIGH). EIP Plus developed by Hundred Plus has an Arbitrary File Uplaod vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution...
How severe is CVE-2025-12867?
CVE-2025-12867 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-12867?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.