关键漏洞信息 TVN ID TVN-202509002 CVE ID CVE-2025-10266 CVE-2025-10267 CVSS CVE-2025-10266: 9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2025-10267: 5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N 受影响产品 NUP Portal version SP5.0 and earlier 描述 CVE-2025-10266 (SQL Injection): Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents. CVE-2025-10267: Unauthenticated remote attackers can directly upload files. If the attacker manages to bypass the file extension restrictions, they could upload a webshell and execute it on the server side. 解决方案 Update to version SP5.1 and later 致谢 ZW Cai (MediaTek CSIRT) 公布日期 2025-09-11