{"id":"CVE-2026-82504","kind":"vulnerability","aliases":["CVE-2026-82504"],"related":[],"title":"VITEC EZ TV Platform Server: unauthenticated file upload gives remote code execution","description":"VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that allows unauthenticated remote attackers to upload arbitrary files by supplying a target filename in the X-FILENAME request header with no authentication or file type validation required. Attackers can upload a malicious ASPX file directly to the web-accessible uploads directory, where it is immediately executable by the web server, achieving remote code execution in the context of the web server process. Patches are available for versions 8.3.0, 8.3.1, 8.4.0, and 8.4.1. Users running releases prior to 8.3.0 should upgrade to 8.5.0+.","summary":"VITEC EZ TV Platform Server before 8.5.0 accepts file uploads from unauthenticated remote attackers, with the target filename taken from the X-FILENAME request header and no file type checks. An attacker can upload an ASPX file to the web-accessible uploads directory and run it on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"VITEC EZ TV Platform Server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aspx","ez-tv-platform","iis","vendor","vitec","windows"],"not_affected_if":["version-8.5.0-or-later"],"how_to_check":"- Check the installed EZ TV Platform Server version against `8.5.0`\n- Look in the web-accessible uploads directory for unexpected `.aspx` files","fix":"- Move EZ TV Platform Server to `8.5.0` or later\n- Patches are stated for `8.3.0`, `8.3.1`, `8.4.0`, and `8.4.1`; releases before `8.3.0` should upgrade to `8.5.0+`","status":"open","published_at":"2026-11-13T21:17:48+00:00","first_seen_at":"2026-11-13T21:33:41+00:00","triaged_at":"2026-11-13T21:33:47+00:00","updated_at":"2026-11-13T21:33:47+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-13T21:33:47Z","model":"claude-haiku-5-5","output":{"fix":"- Move EZ TV Platform Server to `8.5.0` or later\n- Patches are stated for `8.3.0`, `8.3.1`, `8.4.0`, and `8.4.1`; releases before `8.3.0` should upgrade to `8.5.0+`","reach":"internet","title":"VITEC EZ TV Platform Server: unauthenticated file upload gives remote code execution","impact":"high","summary":"VITEC EZ TV Platform Server before 8.5.0 accepts file uploads from unauthenticated remote attackers, with the target filename taken from the X-FILENAME request header and no file type checks. An attacker can upload an ASPX file to the web-accessible uploads directory and run it on the server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["vitec","ez-tv-platform","windows","iis","aspx"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs arbitrary ASPX code as the web server process","analyst_note":"Confirm the vendor's own advisory and the exact affected version list from the vulncheck third-party advisory; the sources give patched versions but not whether 8.2 and earlier ranges are all covered.","how_to_check":"- Check the installed EZ TV Platform Server version against `8.5.0`\n- Look in the web-accessible uploads directory for unexpected `.aspx` files\n- unknown for other checks","plain_action":"","product_name":"VITEC EZ TV Platform Server","needs_analyst":true,"not_affected_if":["version-8.5.0-or-later"],"who_is_affected":"Any organization running VITEC EZ TV Platform Server before 8.5.0 with its upload handler reachable from the internet. The flaw needs no account and no special setting, so exposed deployments are at risk; the sources do not say whether a managed or vendor-hosted deployment is affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000827,"input_tokens":4707,"output_tokens":712,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-82504':15A,18A '8.3.0':171C,181C '8.3.1':172C '8.4.0':173C '8.4.1':175C '8.5.0':39B,90C,185C 'accept':40B 'access':75B,142C 'achiev':154C 'allow':102C 'arbitrari':108C 'aspx':24B,69B,135C 'attack':46B,65B,105C,130C 'authent':124C 'avail':168C 'check':63B 'code':11A,156C 'contain':91C 'context':160C 'cve':13A,16A 'direct':137C 'directori':77B,144C 'execut':12A,149C,157C 'ez':2A,20A,26B,34B,85C 'ez-tv-platform':25B 'file':7A,41B,61B,70B,94C,109C,126C,136C 'filenam':50B,56B,114C,119C 'give':9A 'handler':100C 'header':58B,121C 'ii':29B 'immedi':148C 'malici':134C 'patch':166C 'platform':4A,22A,28B,36B,87C 'prior':179C 'process':165C 'releas':178C 'remot':10A,45B,104C,155C 'request':57B,120C 'requir':129C 'run':79B,177C 'server':5A,23A,37B,83B,88C,153C,164C 'suppli':111C 'taken':51B 'target':49B,113C 'tv':3A,21A,27B,35B,86C 'type':62B,127C 'unauthent':6A,44B,103C 'unrestrict':93C 'upgrad':183C 'upload':8A,42B,67B,76B,95C,99C,107C,132C,143C 'user':176C 'valid':128C 'vendor':30B 'version':170C 'vitec':1A,19A,31B,33B,84C 'vulner':96C 'web':74B,141C,152C,163C 'web-access':73B,140C 'window':32B 'x':55B,118C 'x-filenam':54B,117C","nicknames":[],"mitigations":[],"who_affected":"Any organization running VITEC EZ TV Platform Server before 8.5.0 with its upload handler reachable from the internet. The flaw needs no account and no special setting, so exposed deployments are at risk; the sources do not say whether a managed or vendor-hosted deployment is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["eztvplatformserver","viteceztvplatformserver"],"ptokens":["ez","platform","server","tv","vitec"],"labels":["aspx","critical","eztvplatform","iis","vendor","vitec","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-82504':15A,18A 'code':11A 'cve':13A,16A 'execut':12A 'ez':2A,20A 'file':7A 'give':9A 'platform':4A,22A 'remot':10A 'server':5A,23A 'tv':3A,21A 'unauthent':6A 'upload':8A 'vitec':1A,19A","search_b":"'8.5.0':39B 'accept':40B 'access':75B 'aspx':24B,69B 'attack':46B,65B 'check':63B 'directori':77B 'ez':26B,34B 'ez-tv-platform':25B 'file':41B,61B,70B 'filenam':50B,56B 'header':58B 'ii':29B 'platform':28B,36B 'remot':45B 'request':57B 'run':79B 'server':37B,83B 'taken':51B 'target':49B 'tv':27B,35B 'type':62B 'unauthent':44B 'upload':42B,67B,76B 'vendor':30B 'vitec':31B,33B 'web':74B 'web-access':73B 'window':32B 'x':55B 'x-filenam':54B","search_c":"'8.3.0':171C,181C '8.3.1':172C '8.4.0':173C '8.4.1':175C '8.5.0':90C,185C 'access':142C 'achiev':154C 'allow':102C 'arbitrari':108C 'aspx':135C 'attack':105C,130C 'authent':124C 'avail':168C 'code':156C 'contain':91C 'context':160C 'direct':137C 'directori':144C 'execut':149C,157C 'ez':85C 'file':94C,109C,126C,136C 'filenam':114C,119C 'handler':100C 'header':121C 'immedi':148C 'malici':134C 'patch':166C 'platform':87C 'prior':179C 'process':165C 'releas':178C 'remot':104C,155C 'request':120C 'requir':129C 'run':177C 'server':88C,153C,164C 'suppli':111C 'target':113C 'tv':86C 'type':127C 'unauthent':103C 'unrestrict':93C 'upgrad':183C 'upload':95C,99C,107C,132C,143C 'user':176C 'valid':128C 'version':170C 'vitec':84C 'vulner':96C 'web':141C,152C,163C 'web-access':140C 'x':118C 'x-filenam':117C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T21:17:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82504","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82504","severity":null,"published_at":"2026-11-13T21:17:48+00:00","modified_at":"2026-11-13T21:17:48+00:00","first_seen_at":"2026-11-13T21:33:41+00:00","fetched_at":"2026-11-13T21:33:41+00:00","note":null}],"documents":[{"id":150327,"url":"https://www.vulncheck.com/advisories/vitec-ez-tv-platform-server-unauthenticated-file-upload-via-uploadhandler-ashx","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}