CVE-2025-2155 — Arbitrary File Upload in EchoCCS's Specto CM

Back Back to CVE browser

HIGH

Arbitrary File Upload in EchoCCS's Specto CM

Published Dec 24, 2025

8.8

HIGH

CVSS 3.1

EPSS 0.34%

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Remote Code Inclusion.

This issue affects Specto CM: before 17032025.

Affected products

Vendor Echo Call Center Services Trade and Industry Inc. Product Specto CM Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <17032025

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Echo Call Center Services Trade and Industry Inc.

Specto CM

unaffected

Version	Status	Constraints
0	affected	<17032025

Remediation

No remediation recorded yet.

Metrics

0.34% 0.00338

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.00338

Score over time

2025–2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	0.34% (0.00338)	24.94th	v5 (v2026.06.15)
Jun 15, 2026	0.29% (0.00288)	20.29th	v5 (v2026.06.15)
Dec 25, 2025	0.04% (0.00042)	13.04th	v4 (v2025.03.14)

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (2)

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0480
government-resource
https://www.usom.gov.tr/bildirim/tr-25-0480
government-resourcebroken-link

Link	Providers	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0480		government-resource
https://www.usom.gov.tr/bildirim/tr-25-0480		government-resourcebroken-link