CVE-2021-27964: Sfcyazilim Sonlogger

Critical severity, CVSS 9.8. EPSS: 47.5% chance of exploitation in the next 30 days.

SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Config/SaveUploadedHotspotLogoFile without any authentication or session header. There is no check for the file extension or content of the uploaded file.

Affected products

• Sfcyazilim Sonlogger: before 6.4.1 (fixed in 6.4.1)

Published 2021-03-05. Last modified 2026-06-17.