CVE-2021-27964: SonLogger unauthenticated arbitrary file upload via SaveUploadedHotspotLogoFile

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit code available, and very high EPSS score make this an urgent risk.

What it is

SonLogger before 6.4.1 exposes the /Config/SaveUploadedHotspotLogoFile endpoint without authentication or session checks, and it does not validate the uploaded file's extension or content. An attacker can POST an arbitrary file, including a web shell, to the server. This gives a remote, unauthenticated attacker a direct path to code execution on the host.

Impact

An attacker can upload and execute arbitrary code on the SonLogger server, leading to full compromise of the application and its underlying host. This can result in data theft, lateral movement, and service disruption.

Attack surface

Reachable over the network via a POST request to /Config/SaveUploadedHotspotLogoFile; no authentication, session header, or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Public exploit code is referenced (Packet Storm and a GitHub PoC), and EPSS is 0.47519 (98.8th percentile), indicating high likelihood of exploitation; the CVE is not listed in CISA KEV.

What to do

• Upgrade SonLogger to version 6.4.1 or later, which addresses the vulnerability.
• If immediate upgrade is not possible, restrict network access to the SonLogger web interface to trusted hosts only.
• Add authentication and authorization checks to the /Config/SaveUploadedHotspotLogoFile endpoint and validate uploaded file extensions and content.
• Deploy a WAF rule to block POST requests to /Config/SaveUploadedHotspotLogoFile with executable file types.
• Monitor the upload directory for unexpected executable files and remove them promptly.

Detection

• Monitor web server logs for POST requests to /Config/SaveUploadedHotspotLogoFile, especially from untrusted IPs.
• Alert on file creation events in the SonLogger upload directory, particularly files with .aspx, .asp, .php, .jsp, or other executable extensions.
• Inspect uploaded files for web shell signatures or anomalous content.
• Correlate suspicious uploads with subsequent process execution or outbound network connections from the SonLogger host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.