CVE-2025-34160 AnyShare ServiceAgent API Unauthenticated RCE
Unauthenticated attackers can execute arbitrary commands via the ServiceAgent API, requiring immediate upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34160?
CVE-2025-34160 is a critical command injection vulnerability in Shanghai Aishu Information Technology Co., Ltd. AnyShare, published on 27 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AnyShare contains a critical unauthenticated remote code execution vulnerability in the ServiceAgent API exposed on port 10250. The endpoint /api/ServiceAgent/start_service accepts user-supplied input via POST and fails to sanitize command-like payloads. An attacker can inject shell syntax that is interpreted by the backend, enabling arbitrary command execution. The vulnerability is presumed to affect builds released prior to August 2025 and is said to be remediated in newer versions of the product, though the exact affected range remains undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 UTC.
Weakness: CWE-78
Which versions are affected by CVE-2025-34160?
How do I fix CVE-2025-34160?
No fix has been published for CVE-2025-34160 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-34160 being exploited?
There is no known exploitation of CVE-2025-34160 in the wild and no public exploit code.
Sources
Also known as GHSA-77mc-w6j6-jgvg.