CVE Intelligence
Analysis AI-assisted

CVE-2019-25714: Seeyon OA A8 Unauthenticated Arbitrary File Write via htmlofficeservlet

CVE-2019-25714 affects Seeyon OA A8 and, as described in the record, lets an unauthenticated remote attacker write arbitrary files into the web application root through the /seeyon/htmlofficeservlet endpoint. The record classifies the flaw as CWE-434 and cites a CVSS 4.0 base score of 9.3 from VulnCheck, and notes that Shadowserver first observed exploitation evidence on 2021-03-26 (UTC). The record contains no affected version list, no fix information and no CISA KEV listing.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2019-25714 is described in the record as an unauthenticated arbitrary file write flaw in Seeyon OA A8, reachable through the /seeyon/htmlofficeservlet endpoint. The record maps it to CWE-434 (unrestricted upload of file with dangerous type) and lists VulnCheck as the CNA. The VulnCheck advisory is the main technical reference in the record.

Impact

  • According to the record, a remote attacker without credentials can write files into the web application root.
  • The record states that written script files can be run through the web server, which would give command execution with web server privileges.
  • The CVSS 4.0 vector in the record rates confidentiality, integrity and availability impact as high, with no privileges or user interaction required. The base score is 9.3 and the severity is critical.

Affected products and versions

The product is Seeyon OA A8. The record's affected list is empty, so no specific affected version range is confirmed by the sources provided. Until the vendor or a cited advisory defines the range, treat every deployment of this product as potentially in scope.

Exploitation status

The record states that exploitation evidence was first observed by the Shadowserver Foundation on 2021-03-26 (UTC). The record shows this CVE is not listed in the CISA KEV catalog, so this analysis does not describe it as active exploitation under KEV criteria. No further confirmed exploitation status appears in the sources consulted. The EPSS data in the record gives a probability of 0.00653 and a percentile of 0.49941, dated 2026-10-13.

Remediation and mitigation

  • The record lists no fixed version. A missing fix entry does not prove that no fix exists, so check the vendor and the cited advisories.
  • Inventory all Seeyon OA A8 instances, giving priority to any that are reachable from the internet.
  • Where business needs allow, restrict access to the htmlofficeservlet endpoint at the network or application layer.
  • Where your security platform supports it, evaluate the signatures referenced in the record, such as the Broadcom attack signature page and the FortiGuard IPS entry, as compensating controls.
  • If tampering is suspected, remove unauthorized files from web roots and restore the application from trusted sources.

Detection guidance

  • Review web server logs for POST requests to the htmlofficeservlet endpoint, especially from unexpected sources.
  • Monitor web roots for newly created server-side script files that are not part of the normal deployment.
  • Look for unexpected child processes or outbound connections originating from the web server account.

Limitations of the available information

  • The record contains no affected version data, no fixed version data, no KEV details and no SSVC data.
  • The record's source status is listed as Deferred.
  • The only CVSS data in the record comes from one provider (VulnCheck). No NVD-specific score is shown.
  • The record includes third-party and archived references that were not independently verified for this analysis.

Frequently asked questions

What is CVE-2019-25714?

It is a flaw in Seeyon OA A8 that, according to the record, lets an unauthenticated remote attacker write arbitrary files into the web application root through the /seeyon/htmlofficeservlet endpoint.

Is there a confirmed fixed version?

No. The record lists no fixed version, so the fix status is unknown. Check the vendor and the cited advisories for current guidance.

Is this vulnerability listed in CISA KEV?

The record shows it is not listed in the KEV catalog. The record does note that Shadowserver first observed exploitation evidence on 2021-03-26 (UTC), but this analysis does not call it active exploitation under KEV criteria.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.