This vulnerability (CVE-2025-34046) affects the Fanwei E-Office web management interface, specifically the /general/index/UploadFile.php endpoint when called with uploadType parameters 'eoffice_logo' or 'theme'. Due to improper validation of uploaded files, unauthenticated attackers can upload malicious files, potentially achieving remote code execution on the server hosting the application. The CVSS 4.0 base score is 10.0, reflecting the critical nature of this flaw with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. Exploitation evidence was confirmed by Shadowserver Foundation on 2025-02-05 UTC. The vendor has not published a patch or advisory at this time.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, leading to remote code execution on the affected server. This can result in complete compromise of the web application and potentially the underlying operating system, risking data theft, service disruption, and further network penetration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable endpoint, implement web application firewall (WAF) rules to block suspicious file uploads targeting the specified parameters, and monitor for exploitation attempts. Avoid exposing the affected interface to untrusted networks where possible.