Impact

Successful exploitation of this vulnerability allows unauthenticated remote attackers to gain unauthorized access to the affected command and dispatch platform. By uploading malicious files (such as web shells), attackers can achieve remote code execution, potentially resulting in full system takeover, exfiltration of sensitive command data, and disruption of critical dispatch services. Given the nature of command and dispatch systems, the potential for operational impact is significant.

Recommendation

Detection engineering teams should focus on identifying unauthorized attempts to interact with the identified upload endpoint.

• Deploy the provided Sigma rule to monitor for suspicious POST requests to the vulnerable upload URI.
• Inspect web server access logs for requests to /dm/dispatch/userinfo/upload that do not originate from authorized administrative workflows or that exhibit unusual user-agent strings.
• Restrict network access to the management and dispatch platform interfaces to only trusted IP ranges via internal firewalls or VPNs to mitigate remote exploitation risks.