CVE-2025-0645: Pyxis Signage File Upload Vulnerability

CVE-2025-0645 Overview

CVE-2025-0645 is an unrestricted file upload vulnerability in Pyxis Signage, a digital signage product developed by Narkom Communication and Software Technologies Trade Ltd. Co. The flaw exists in functionality that is not properly constrained by access control lists (ACLs), allowing authenticated users to upload files of dangerous types. The vulnerability affects Pyxis Signage versions through 31012025. The weakness is classified under [CWE-434] (Unrestricted Upload of File with Dangerous Type). Successful exploitation can lead to arbitrary code execution on the host system serving the signage application.

Critical Impact

Authenticated attackers can upload executable file types and abuse weak ACL enforcement to compromise confidentiality, integrity, and availability of the Pyxis Signage system.

Affected Products

• Narkom Pyxis Signage through build 31012025
• Deployments exposing the Pyxis Signage management interface over the network
• Any environment relying on Pyxis Signage for content delivery prior to the vendor fix

Discovery Timeline

• 2025-11-20 - CVE-2025-0645 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-0645

Vulnerability Analysis

The vulnerability stems from improper validation of uploaded file types in the Pyxis Signage application. The upload handler does not enforce server-side restrictions on file extensions, MIME types, or content inspection. Attackers with valid high-privilege credentials can upload server-executable file types such as web shells or scripts interpreted by the signage backend. The issue is compounded by access control gaps: functionality intended for restricted roles is reachable without proper ACL checks, broadening the attack surface beyond what the privilege model implies.

Root Cause

The root cause is twofold. First, the file upload component lacks an allowlist of safe content types and trusts client-supplied metadata. Second, server-side authorization checks do not constrain the upload endpoint to the appropriate roles. Together, these flaws map directly to [CWE-434], where dangerous file types reach a location where the server can execute or interpret them.

Attack Vector

The attack is conducted over the network against the Pyxis Signage management interface. An attacker with valid high-privilege credentials submits a crafted multipart upload containing an executable payload, such as a server-side script. After upload, the attacker requests the file through the web interface to trigger execution. Because the surrounding functionality is not constrained by ACLs, lateral movement within the application is possible once a foothold is established. No verified public proof-of-concept code is available at this time; refer to the USOM Security Advisory TR-25-0404 for additional technical details.

Detection Methods for CVE-2025-0645

Indicators of Compromise

• Unexpected files with executable extensions (.php, .asp, .aspx, .jsp) inside Pyxis Signage upload or media directories
• HTTP POST requests to upload endpoints originating from unusual source IPs or outside business hours
• New child processes spawned by the Pyxis Signage web service that invoke shells or scripting interpreters
• Outbound network connections from the signage host to unfamiliar external infrastructure

Detection Strategies

• Inspect web server access logs for POST requests to upload handlers followed by GET requests to the same uploaded resource
• Monitor the application's media and upload directories for files whose content type does not match the declared extension
• Alert on process execution chains where the signage service spawns interpreters or system utilities

Monitoring Recommendations

• Forward Pyxis Signage application and web server logs to a centralized logging platform for retention and correlation
• Track authentication events for high-privilege accounts and flag uploads performed shortly after privileged logons
• Baseline normal file types within signage content directories and alert on deviations

How to Mitigate CVE-2025-0645

Immediate Actions Required

• Restrict network access to the Pyxis Signage management interface to trusted administrative networks only
• Rotate credentials for all privileged Pyxis Signage accounts and enforce strong password policies
• Audit upload directories for unexpected files and remove any suspicious artifacts
• Review the USOM Security Advisory TR-25-0404 and contact the vendor for a fixed build

Patch Information

The advisory identifies versions through build 31012025 as affected. Administrators should contact Narkom Communication and Software Technologies Trade Ltd. Co. directly to obtain a patched release that enforces server-side file type validation and proper ACLs on upload functionality. Until a vendor patch is confirmed, treat the application as exposed and apply compensating controls.

Workarounds

• Place the Pyxis Signage interface behind a VPN or zero-trust network gateway to limit exposure
• Deploy a reverse proxy or web application firewall rule that blocks uploads of executable file extensions
• Configure the web server to deny script execution within upload and media directories
• Limit high-privilege account usage to dedicated administrative workstations

# Example nginx configuration to deny script execution in upload paths
location ~* ^/uploads/.*\.(php|phtml|asp|aspx|jsp|jspx|sh|cgi|pl|py)$ {
    deny all;
    return 403;
}