CVE-2025-2702: Softwin WMX3 Unrestricted Upload Vulnerability

CVE-2025-2702 Overview

CVE-2025-2702 is an unrestricted file upload vulnerability in Softwin WMX3 version 3.1. The flaw resides in the ImageAdd function of /ImageAdd.ashx, where the File parameter accepts arbitrary uploads without proper validation. Attackers can exploit this issue remotely over the network with low-privileged authentication. The vulnerability is classified under [CWE-284] (Improper Access Control). The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts before publication.

Critical Impact
Remote authenticated attackers can upload arbitrary files through ImageAdd.ashx, potentially leading to code execution on the underlying web server.

Affected Products

Softwin WMX3 3.1
/ImageAdd.ashx handler component
Deployments exposing the WMX3 web interface to untrusted networks

Discovery Timeline

2025-03-24 - CVE-2025-2702 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2702

Vulnerability Analysis

The vulnerability exists in the ImageAdd function exposed through the /ImageAdd.ashx ASP.NET HTTP handler. The handler accepts file uploads via the File parameter without enforcing content-type, extension, or magic-byte validation. An authenticated attacker can submit executable server-side content, such as .aspx or .ashx files, that the web server may later process. Successful exploitation depends on the upload destination being reachable through the web root. The public GitHub proof-of-concept demonstrates the path from upload to remote code execution.

Root Cause

The root cause is missing access control and input validation within the ImageAdd handler. The endpoint treats the File parameter as trusted image content and writes it directly to disk. No allow-list of extensions, MIME types, or file signatures is enforced. This maps to [CWE-284] Improper Access Control, where sensitive functionality lacks authorization boundaries.

Attack Vector

Exploitation requires network access to the WMX3 web interface and low-privileged credentials. The attacker issues an HTTP POST request to /ImageAdd.ashx with a crafted File payload containing server-executable code. Once the file lands within the web root, the attacker requests its URL to trigger execution. See the VulDB entry #300719 for additional technical context. Because the attack is network-based and does not require user interaction, opportunistic scanning is a plausible exploitation pattern.

No verified exploit code is republished here. Refer to the public
proof-of-concept linked in the External References for details on
the request structure and file payload used against ImageAdd.ashx.

Detection Methods for CVE-2025-2702

Indicators of Compromise

HTTP POST requests to /ImageAdd.ashx originating from unexpected source IPs or user agents.
Newly created files in WMX3 upload directories with executable extensions such as .aspx, .ashx, .asmx, or .config.
Subsequent GET requests to uploaded files returning HTTP 200 with dynamic content responses.
Outbound network connections from the WMX3 IIS worker process (w3wp.exe) to unfamiliar hosts.

Detection Strategies

Inspect IIS logs for requests to ImageAdd.ashx where the response indicates a written file, correlated with follow-up requests to the same uploaded resource.
Deploy web application firewall rules that block uploads whose payloads contain server-side script markers such as <%@ Page or Runat="server".
Monitor file integrity in WMX3 image and upload directories to flag new executable file types.

Monitoring Recommendations

Alert on process trees where w3wp.exe spawns cmd.exe, powershell.exe, or other interpreters shortly after an ImageAdd.ashx request.
Forward IIS and endpoint telemetry to a centralized analytics platform and retain sufficient history to trace upload-to-execution chains.
Baseline normal file types written under WMX3 upload paths and alert on deviations.

How to Mitigate CVE-2025-2702

Immediate Actions Required

Restrict network access to the WMX3 web interface using firewall rules or reverse proxy authentication until a fix is available.
Revoke or rotate credentials for any WMX3 account that is not strictly required, since exploitation requires authentication.
Audit WMX3 upload directories for suspicious files created since deployment and remove any unauthorized artifacts.
Enforce execution restrictions on upload directories by configuring IIS to deny script execution in those paths.

Patch Information

No vendor patch has been published. The disclosure record notes that Softwin did not respond to coordinated disclosure attempts. Track the VulDB advisory #300719 and vendor channels for updates. Until an official fix ships, apply the compensating controls described below.

Workarounds

Disable the /ImageAdd.ashx handler in IIS if the image upload feature is not required.
Add a request-filtering rule in web.config to deny uploads with executable extensions and to enforce a maximum content length.
Place the WMX3 application behind an authenticating reverse proxy that restricts access to trusted operators.
Store uploaded files outside the web root or on a separate volume mounted with the noexec equivalent policy for the application pool identity.

bash

# IIS request filtering example - deny executable uploads via web.config
# <system.webServer>
#   <security>
#     <requestFiltering>
#       <fileExtensions allowUnlisted="true">
#         <add fileExtension=".aspx" allowed="false" />
#         <add fileExtension=".ashx" allowed="false" />
#         <add fileExtension=".asmx" allowed="false" />
#         <add fileExtension=".config" allowed="false" />
#       </fileExtensions>
#       <requestLimits maxAllowedContentLength="2097152" />
#     </requestFiltering>
#   </security>
# </system.webServer>