CVE-2024-11312

The lack of authentication required for file uploads combined with the absence of file extension or type validation allows an attacker to upload any file (e.g., webshell). The path traversal vulnerability enables placing this file outside the default upload directory — including locations accessible by the web server. After uploading the file, the attacker can invoke it through a browser or HTTP request, thereby achieving code execution on the server side.

An unauthenticated attacker can gain full control over the server by executing arbitrary code (RCE), as well as read, modify, or delete data on the server.

Apply patches available from the vendor according to references published by TWCERT (https://www.twcert.org.tw/en/cp-139-8249-65252-2.html). Until updates are applied, it is recommended to restrict network access to the application and block unauthorized traffic at the firewall level.

TRCore DVC product — specific versions indicated in vendor references (TWCERT).