A critical remote code execution vulnerability in ICS-Park Smart Park Management System v2.0 enables unauthenticated attackers to gain full system control.

The application contains an unrestricted file upload vulnerability within its upload module. This flaw permits an unauthenticated attacker to upload and execute malicious files, leading to remote code execution.

Successful exploitation of this vulnerability results in full system compromise, allowing an attacker to execute arbitrary code with the privileges of the web server. Given the CVSS score of 9.8, this represents a critical risk that could lead to complete data exfiltration, unauthorized administrative access, and potential lateral movement within the production network.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the file upload module or disable the affected service if it is not business critical.

Proactive Monitoring: Monitor web server access logs for suspicious file uploads or requests to directories where user-uploaded files are stored, particularly those containing executable extensions.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests that attempt to upload unauthorized file types or interact with known vulnerable endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked research repository.

Due to the critical nature of this remote code execution flaw, immediate isolation of the affected Smart Park Management System is required. Security teams should monitor for vendor updates and apply them as soon as they become available. Until a formal patch is released, implementing strict network segmentation and firewall rules to limit exposure is necessary to prevent unauthorized exploitation.