CVE-2025-2155 Arbitrary File Upload in EchoCCS's Specto CM
Attackers can upload malicious files to Specto CM to achieve remote code execution, requiring an upgrade to the latest version.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-2155?
CVE-2025-2155 is a high-severity vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM, published on 24 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Unrestricted Upload of File with Dangerous Type vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Remote Code Inclusion.
This issue affects Specto CM: before 17032025.
Weakness: CWE-434
Which versions are affected by CVE-2025-2155?
How do I fix CVE-2025-2155?
No fix has been published for CVE-2025-2155 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-2155 being exploited?
There is no known exploitation of CVE-2025-2155 in the wild and no public exploit code.
Sources
Also known as GHSA-pgph-4c45-hj8g.