CVE-2012-6274: BigAnt IM Message Server unauthenticated file upload allows arbitrary file creation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityUnauthenticated remote file write with a very high EPSS percentile, though impact is limited to integrity per the CVSS vector and no KEV listing exists.

What it is

BigAntSoft BigAnt IM Message Server does not require authentication for file uploads, letting a remote attacker write arbitrary files into the AntServer\DocData\Public directory. Because the write path is fixed and unauthenticated, any network-reachable attacker can plant files on the server, which matters for integrity and possible follow-on abuse of uploaded content.

Impact

An attacker gains the ability to create arbitrary files on the server under the public document directory without credentials. Depending on what the server does with those files, this can corrupt data or enable further attacks, though the record does not specify code execution.

Attack surface

Reachable over the network (AV:N) with no authentication required (Au:N) and no user interaction indicated. The flaw is in the file upload handling of the IM message server.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record; EPSS is 0.46868 (98.8th percentile), indicating a high predicted likelihood of exploitation activity.

What to do

• Apply the vendor fix or the CERT/CC-recommended remediation for VU#990652 as soon as possible.
• Require authentication and authorization checks on all file upload endpoints.
• Restrict write access to AntServer\DocData\Public and validate uploaded file types and names.
• Place the IM server behind a firewall or VPN so upload services are not exposed to untrusted networks.
• Monitor and alert on unexpected file creation in the public document directory.

Detection

• Monitor AntServer\DocData\Public for new or unexpected files and alert on writes outside normal business patterns.
• Audit server logs for unauthenticated upload requests to the IM message server.
• Baseline the file types and sizes normally uploaded and flag deviations.
• Watch for files with executable or script extensions appearing in the public document directory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.