Arbitrary File Upload Vulnerability in WinMatrix3 by Simopro Technology
CVE-2025-7917

8.6HIGH

Key Information:

Vendor

Simopro Technology

Status
Winmatrix3 Web Package
Vendor
CVE Published:
21 July 2025

What is CVE-2025-7917?

Simopro Technology's WinMatrix3 web package has a vulnerability that permits remote attackers with administrator privileges to upload malicious files. This flaw enables the execution of web shell backdoors, allowing unauthorized access and control over the server. Proper remediation and version updates are crucial to mitigate this security risk.

Affected Version(s)

WinMatrix3 Web package 0 <= 1.2.38.1

References

https://www.twcert.org.tw/tw/cp-132-10258-16bbf-1.html
third-party-advisory
https://www.twcert.org.tw/en/cp-139-10263-5f2e7-2.html
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-7917 : Arbitrary File Upload Vulnerability in WinMatrix3 by Simopro Technology