CVE-2026-33560: DMP-5000 File Service RCE Vulnerability

CVE-2026-33560 Overview

CVE-2026-33560 is an unrestricted file upload vulnerability [CWE-434] affecting the DMP-5000 file service. The service exposes authenticated endpoints that accept files of any type without validation. No file extension filtering or content inspection is enforced, allowing executable binaries and scripts to be written directly to the server.

An authenticated attacker can upload arbitrary payloads to the target system. The flaw affects industrial control system (ICS) environments, as documented in the CISA ICS Advisory ICSA-26-176-04. Successful exploitation can compromise the integrity of the device and enable follow-on actions against downstream systems.

Critical Impact
Authenticated attackers can upload executable binaries or scripts to the DMP-5000 file service without validation, enabling potential persistence, tampering, or lateral movement within ICS networks.

Affected Products

DMP-5000 file service (see CISA ICS Advisory ICSA-26-176-04 for specific version details)
Deployments exposing the DMP-5000 file upload endpoints to authenticated users
Environments using DMP-5000 within operational technology (OT) networks

Discovery Timeline

2026-06-26 - CVE-2026-33560 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-33560

Vulnerability Analysis

The DMP-5000 file service accepts uploads from authenticated users through exposed endpoints. The service performs no server-side validation on the file type, extension, or content. This allows any authenticated user to write files of arbitrary type directly to the underlying filesystem.

Because executable binaries and shell scripts are accepted, an attacker with valid credentials can stage tooling on the device. Depending on the storage location and execution permissions, uploaded content may be invoked by other services, scheduled tasks, or manual operator actions. The vulnerability is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Root Cause

The root cause is missing input validation on the file upload handler. The service does not enforce an allowlist of permitted extensions, does not inspect MIME types, and does not perform content signature checks. It also does not sanitize filenames or enforce a non-executable storage path.

Attack Vector

Exploitation requires network access to the DMP-5000 file service and valid low-privilege credentials. The attacker sends a crafted HTTP request to an exposed upload endpoint containing a malicious binary or script payload. The service writes the file to disk without transformation.

Because no code sample is published in the advisory, defenders should reference the CISA ICS Advisory ICSA-26-176-04 and the CSAF JSON resource for exact endpoint paths and affected versions.

Detection Methods for CVE-2026-33560

Indicators of Compromise

Unexpected executable files (.exe, .sh, .bin, .py) written to DMP-5000 storage directories
HTTP POST requests to file upload endpoints containing binary content types or non-standard extensions
New processes spawned from directories associated with DMP-5000 uploads
Authenticated sessions performing uploads outside normal operator workflows or business hours

Detection Strategies

Monitor DMP-5000 file service logs for upload requests and correlate against expected file types
Deploy filesystem integrity monitoring on directories used by the DMP-5000 upload handler
Inspect network traffic to the file service for anomalous content types and payload sizes
Alert on any script or executable file appearing in upload paths, which should not occur under normal operation

Monitoring Recommendations

Enable verbose audit logging on the DMP-5000 service and forward logs to a centralized SIEM
Baseline normal upload activity per authenticated account and alert on deviations
Review authentication logs for unusual login sources preceding upload activity

How to Mitigate CVE-2026-33560

Immediate Actions Required

Restrict network access to the DMP-5000 file service using firewall rules and place it behind a jump host
Rotate credentials for all accounts with upload privileges and enforce strong authentication
Audit existing upload directories for unauthorized executable content and remove any suspicious files
Review CISA ICS Advisory ICSA-26-176-04 for vendor-provided remediation guidance

Patch Information

At the time of publication, refer to the CISA ICS Advisory ICSA-26-176-04 and the associated CSAF JSON advisory for current patch availability and vendor mitigation instructions. Apply vendor updates as soon as they are validated for the affected environment.

Workarounds

Segment the DMP-5000 device into an isolated OT network zone with strict east-west controls
Disable the file upload endpoints if they are not required for operational workflows
Enforce least privilege on service accounts and remove upload rights from users that do not require them
Deploy a reverse proxy in front of the service to enforce file type allowlists and size limits

bash

# Example: restrict access to the DMP-5000 file service using iptables
iptables -A INPUT -p tcp --dport <service_port> -s <management_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport <service_port> -j DROP