CVE-2025-34160
AnyShare ServiceAgent API Unauthenticated RCE
- State
- Published
- Severity
- 10.0 Critical
- Published
- Aug 27, 2025
- Updated
- May 26, 2026
- Reserved
- Apr 15, 2025
Description
AnyShare contains a critical unauthenticated remote code execution vulnerability in the ServiceAgent API exposed on port 10250. The endpoint /api/ServiceAgent/start_service accepts user-supplied input via POST and fails to sanitize command-like payloads. An attacker can inject shell syntax that is interpreted by the backend, enabling arbitrary command execution. The vulnerability is presumed to affect builds released prior to August 2025 and is said to be remediated in newer versions of the product, though the exact affected range remains undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 UTC.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 10.0 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | VulnCheck |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
AnyShareShanghai Aishu Information Technology Co., Ltd. |
|
References
- https://cn-sec.com/archives/4320091.htmltechnical-descriptionexploit
- https://stack.chaitin.com/vuldb/detail/b4640952-9be9-4bfa-9d7f-a0be72b35e18third-party-advisory
- https://www.aishu.cn/cnproduct
- https://www.aishutech.com/en/anyshare-family7productpatch
- https://www.vulncheck.com/advisories/anyshare-serviceagent-api-unauthenticated-rcethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.