This vulnerability, identified as CWE-434, affects the Specto CM product from Echo Call Center Services Trade and Industry Inc. It allows an attacker with at least low privileges to upload files without proper restrictions on file types. This can lead to remote code inclusion, enabling execution of arbitrary code on the affected system. The vulnerability is exploitable remotely without user interaction and impacts confidentiality, integrity, and availability at a high level. The affected versions are all prior to 17032025. No patch or official fix information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on the affected system, potentially leading to full system compromise. The CVSS vector indicates network attack vector, low attack complexity, privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. This represents a critical risk to affected organizations running vulnerable versions of Specto CM.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected application to trusted users only and monitor for suspicious file upload activity. Avoid exposing the vulnerable service to untrusted networks. Follow vendor communications closely for updates on patches or official mitigations.