Unrestricted File Upload in Birtech Information Technologies' Sensaway
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
Unrestricted Upload of File with Dangerous Type vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Sensaway allows Upload a Web Shell to a Web Server. This issue affects Sensaway: through 09022026. NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer technology.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Birtech Information Technologies Industry and Trade Ltd. Co. | Sensaway | up to 09022026 | — | No fix listed | CNA |
- Sensaway VendorBirtech Information Technologies Industry and Trade Ltd. Co. Affected up to 09022026 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-10465
- 2026-10-03 Alias added: GHSA-f79j-f93q-8h36
References
More Birtech Information Technologies Industry and Trade Ltd. Co. vulnerabilities
- TI-2025-09593 Improper Authentication in Birtech Information Technologies' Sensaway CVSS 3.1HIGH 7.3
- TI-2025-09594 Cleartext password storage in Birtech Information Technologies' Sensaway CVSS 3.1MEDIUM 6.5
Sources
- CVE-2025-10465 · CVE Program
- CVE-2025-10465 · NVD
- FIRST EPSS
- GHSA-f79j-f93q-8h36 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences