MSoft MFlash Arbitrary Code Execution Vulnerability

A vulnerability in the MSoft MFlash application allows for arbitrary code execution on the server. This issue arises from inadequate validation of parameters in the integration configuration feature, which is accessible only to MFlash administrators. The vulnerability affects MFlash version 8.0 and potentially other versions.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of code on the server, potentially allowing an attacker to manipulate the server or its data, or to execute malicious payloads.

Remediation

Users can apply the 8.2-653 hotfix 11.06.2025 or later to address this vulnerability.