This vulnerability arises from improper input validation (CWE-20) in the EVbee DC-80 product. The affected webserver endpoint processes a POST request containing a filename parameter in the Content-Disposition header without verifying its validity, enabling attackers to write files to arbitrary locations on the system. This can be leveraged to overwrite critical system files causing denial of service or to overwrite executable shell scripts, potentially allowing remote code execution when those scripts are triggered by other means. The CVSS 4.0 base score is 9.3, reflecting high impact and ease of exploitation without privileges or user interaction.

Successful exploitation can result in denial of service by corrupting or overwriting essential system files, disrupting normal device operation. Additionally, it can enable remote code execution by replacing shell scripts with malicious code, which can be executed through other mechanisms, potentially leading to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor EVbee's advisories for updates and apply patches once available. Until then, restricting access to the vulnerable endpoint and implementing network-level controls to limit exposure may reduce risk.