CVE-2025-12867: Hundred Plus｜EIP Plus - Arbitrary File Uplaod
Published Nov 10, 2025
·Updated
EIP Plus developed by Hundred Plus has an Arbitrary File Uplaod vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
Affected Software
1 affected component
Hundred Plus EIP Plus
Remediation
Information
Update to version RELEASE_240626 or later.
Event History
Nov 10, 2025
CVE Published
via MITRE·03:02 AM
Data Sourced
via MITRE·03:02 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·04:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-12867?
CVE-2025-12867 is considered a critical vulnerability due to its potential for arbitrary code execution.
2
How do I fix CVE-2025-12867?
To fix CVE-2025-12867, ensure that you apply the latest security updates provided by Hundred Plus for EIP Plus.
3
What type of vulnerability is CVE-2025-12867?
CVE-2025-12867 is classified as an Arbitrary File Upload vulnerability.
4
Who is affected by CVE-2025-12867?
CVE-2025-12867 affects users of Hundred Plus EIP Plus where the software is improperly configured.
5
What are the consequences of exploiting CVE-2025-12867?
Exploiting CVE-2025-12867 can lead to remote code execution, allowing attackers to gain unauthorized control over the server.