CVE-2026-13547: Unrestricted File Upload in Hanwang e-Face 6.3.5.4 – CVSS 7.3 HIGH

Technical summary

CVE-2026-13547 is an unrestricted file upload vulnerability (CWE-434) combined with improper access control (CWE-284) in Hanwang e-Face General Management Platform 6.3.5.4. The vulnerability exists in the file upload handler at /manage/resourceUpload/upload.do, where insufficient validation of the File parameter allows an unauthenticated attacker to circumvent upload restrictions. The attack vector is network-based with low complexity, no user interaction required, and impacts the affected system's confidentiality, integrity, and availability. CVSS v3.1 base score is 7.3 (HIGH severity).

Business impact

Successful exploitation enables attackers to upload and potentially execute arbitrary files on the e-Face platform server, which could lead to remote code execution, lateral movement within your network, data theft, and system compromise. Organizations using e-Face for biometric identification and access management face operational disruption, credential theft, and regulatory compliance violations if personal biometric data is exfiltrated. The public disclosure increases the likelihood of opportunistic scanning and exploitation by threat actors.

Affected systems

Hanwang e-Face General Management Platform version 6.3.5.4 is confirmed affected. Organizations running this version should assume their instances are vulnerable unless patches have been applied. No information on fixed versions is available in the advisory; verify the latest available releases and security bulletins from Hanwang to determine upgrade paths.

Exploitability

This vulnerability has moderate-to-high exploitability. Attack requirements are minimal: no authentication, no user interaction, and standard network access are sufficient. The public disclosure of the vulnerability means exploit tooling or working proof-of-concept code may become available or already exists in threat actor toolkits. Automated scanning and exploitation attempts against internet-exposed instances are probable.

Remediation

Immediately identify all instances of Hanwang e-Face General Management Platform 6.3.5.4 within your environment. Consult Hanwang's security advisories for available patches and upgrade to a patched version. As an interim measure, restrict network access to the /manage/resourceUpload/upload.do endpoint via firewall or WAF rules to trusted internal networks only. Implement strict input validation and file type whitelisting on all upload handlers. Monitor upload directories for suspicious file activity.

Patch guidance

Contact Hanwang support or check their security portal for patches addressing CVE-2026-13547. Verify the patch version against the official vendor advisory before deployment. Apply patches in a controlled manner, testing first in non-production environments. Given the HIGH severity and public disclosure, prioritize this update ahead of routine maintenance cycles.

Detection guidance

Monitor web server logs for POST requests to /manage/resourceUpload/upload.do with unusual File parameters or suspicious file extensions. Deploy web application firewalls configured to detect and block file upload bypass attempts. Review uploaded files in the application's resource directory for unexpected binaries, scripts, or archives. Enable verbose logging of upload operations and set alerts for failed or suspicious upload attempts. Implement endpoint detection and response (EDR) monitoring on servers running e-Face to detect suspicious process execution following potential file uploads.

Why prioritize this

This vulnerability ranks HIGH priority due to its remote exploitability without authentication, confirmed public disclosure, and direct impact on system integrity and confidentiality. File upload vulnerabilities are frequently chained with other attacks to achieve code execution. Organizations using e-Face in security-critical environments (identity verification, access control) must remediate urgently to prevent unauthorized access and data exfiltration.

Risk score, explained

CVSS 3.1 score of 7.3 reflects a HIGH severity vulnerability with network attack vector, low complexity, no privilege requirements, and no user interaction. The impact on all three security properties (confidentiality, integrity, availability) elevates the score. While not rated as critical, the combination of unauthenticated remote access, public disclosure, and practical exploitability makes this an urgent priority for patching.

Frequently asked questions