CVE-2025-10398: Fcba_zzm Smart Park RCE Vulnerability

CVE-2025-10398 Overview

CVE-2025-10398 is an unrestricted file upload vulnerability in fcba_zzm ics-park Smart Park Management System 2.0. The flaw resides in FileUploadUtils.java, where the File argument is processed without proper validation. Authenticated attackers can deliver arbitrary file content remotely over the network. The weakness maps to [CWE-284] (Improper Access Control) and affects integrity, confidentiality, and availability at a limited scope. Public exploit details have been disclosed, increasing the risk of opportunistic abuse against exposed instances.

Critical Impact
Remote attackers with low-privilege accounts can upload arbitrary files to vulnerable Smart Park Management System 2.0 deployments, enabling potential webshell delivery and follow-on compromise.

Affected Products

fcba_zzm ics-park Smart Park Management System 2.0
Component: FileUploadUtils.java
CPE: cpe:2.3:a:fcba_zzm:smart_park_management_system:2.0:*:*:*:*:*:*:*

Discovery Timeline

2025-09-14 - CVE-2025-10398 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10398

Vulnerability Analysis

The vulnerability resides in the file upload handler implemented in FileUploadUtils.java. The component accepts a File argument from client-supplied input and writes it to the server without enforcing restrictions on file type, extension, or content. This unrestricted upload behavior aligns with [CWE-284], improper access control over file handling routines.

Attackers reach the vulnerable code path over the network. The exploit requires low privileges and no user interaction. Once a malicious file is staged on the server, attackers can pursue server-side code execution by uploading scripts the application server will interpret, such as .jsp payloads, depending on deployment configuration.

Public disclosure on VulDB and GitHub increases the likelihood of automated scanning against exposed Smart Park Management System 2.0 instances. The EPSS probability remains low, reflecting limited observed activity at the time of publication.

Root Cause

The root cause is missing server-side validation in the FileUploadUtils.java upload routine. The handler trusts the File parameter without enforcing an allow-list of extensions, MIME type verification, content inspection, or a constrained storage path outside the web root.

Attack Vector

The attack vector is network-based. An authenticated user with low privileges sends a crafted multipart upload request to the vulnerable endpoint backed by FileUploadUtils.java. Because the routine does not restrict file types, the attacker can place executable content in a location served by the application. The vulnerability description in public references confirms that exploitation has been released to the public.

No verified exploit code is reproduced here. Refer to the GitHub Issue Discussion and the VulDB advisory for technical details.

Detection Methods for CVE-2025-10398

Indicators of Compromise

Unexpected files with executable extensions (.jsp, .jspx, .war, .sh) written to upload directories used by the Smart Park Management System.
Outbound connections initiated by the application server process shortly after multipart upload requests.
New or modified files under web-accessible paths that do not match legitimate upload patterns.

Detection Strategies

Inspect application and web server access logs for POST requests to upload endpoints handled by FileUploadUtils.java with non-image or non-document content types.
Deploy file integrity monitoring on upload directories to flag creation of script files.
Review authentication logs for low-privilege accounts performing repeated upload operations followed by direct requests to the uploaded resources.

Monitoring Recommendations

Centralize web server, application, and host logs for correlation across upload and execution events.
Alert on process spawns by the application server JVM that are inconsistent with normal workload, such as shell interpreters or network utilities.
Track HTTP responses returning newly created file paths under user-controlled directories.

How to Mitigate CVE-2025-10398

Immediate Actions Required

Restrict network exposure of the Smart Park Management System 2.0 administrative and upload endpoints to trusted networks only.
Audit upload directories for unauthorized files and remove any unverified content.
Revoke or rotate credentials for low-privilege accounts that could be abused to reach the vulnerable endpoint.

Patch Information

No vendor advisory or official patch URL is published in the NVD record for CVE-2025-10398 at the time of writing. Monitor the VulDB entry and the GitHub issue tracker for vendor updates or community remediation guidance.

Workarounds

Enforce an allow-list of permitted file extensions and validate MIME types server-side before persisting uploads.
Store uploaded files outside the web root and serve them through a controlled handler that disables script interpretation.
Deploy a web application firewall rule that blocks multipart uploads containing executable extensions to the affected endpoint.
Disable the upload feature entirely if it is not required for business operations.

bash

# Example WAF rule (ModSecurity) blocking executable uploads to the affected endpoint
SecRule REQUEST_URI "@contains /upload" \
    "phase:2,deny,status:403,id:1010398,\
    chain,msg:'Block executable file upload (CVE-2025-10398)'"
    SecRule FILES_NAMES "@rx \.(jsp|jspx|war|sh|php|exe)$" "t:lowercase"