CVE-2025-2494 is a critical unrestricted file upload flaw (CVSS 9.8) in Sytel Softdial Contact Center, where the upload.php endpoint can place files in a web exposed directory and lead to code execution. The record lists no fixed version. Read the INCIBE notice, restrict access to the console and check the upload folder.
What's affected
The NVD record names Sytel Softdial Contact Center. The description says an attacker could upload files to the server through the /softdial/phpconsole/upload.php endpoint, which is protected by basic HTTP authentication. The files land in a directory that the web application exposes, which could result in code execution and full control of the server.
The record gives no version range. The reference is an INCIBE notice titled multiple vulnerabilities in Softdial Contact Center, and I could not retrieve it, so check it for affected versions. The vector shows no privileges required, while the description mentions basic HTTP authentication, so confirm in the notice how that protection can be met.
The record is not on the CISA Known Exploited Vulnerabilities list.
The weakness is classed as CWE-434 (unrestricted upload of a file with a dangerous type). The score is 9.8 (CRITICAL). The vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reads as reachable over the network, low attack complexity, no privileges required and no user interaction. Impact is high on confidentiality, high on integrity and high on availability. The record was published on 2025-03-18.
The record names no fixed version. Check the INCIBE notice and contact Sytel for the release that addresses it.
How to check if you're exposed
Softdial is a contact center platform that you run yourself, so start with where and how it is exposed.
- Identify installs of Softdial Contact Center and record the version from the console or your deployment records.
- Check whether the
/softdial/phpconsole/path is reachable from the internet. - Look in the directory that receives uploads for files that should not be there, especially scripts such as PHP files.
find /var/www -path "*softdial*" -name "*.php" -mtime -90 2>/dev/null
- Review web server logs for POST requests to the upload endpoint, and note the source addresses.
- Check how basic authentication is set up, and whether the accounts that can sign in use strong unique passwords.
What to do now
- Restrict the Softdial PHP console to trusted networks or a VPN, and take it off the internet.
- Read the INCIBE notice, contact Sytel and apply the vendor fix as soon as one is available.
- Inspect the upload directory for unexpected files, and remove only what you have confirmed is unwanted, after keeping a copy for review.
- Stop the web server from executing scripts in the upload directory.
- Rotate the console's credentials and review accounts, and if you find a suspicious file, treat the server as compromised and respond accordingly.
Why it matters
Unrestricted upload of a file with a dangerous type, listed as CWE-434, happens when an upload feature accepts any file and stores it somewhere the server will run it. A script saved in a web reachable folder can be requested like a page, and the server then executes it. That is the shortest path from upload to control of the machine.
The defences are well known: allow only the file types you need, store uploads outside the web root, give files names you choose and never execute anything from the upload folder. A contact center system also touches call data and customer details, so a compromised server is more than an IT problem.
If you track many applications, the free in-browser dependency scan at gold.safeguard.sh/scan can show which of your components have known CVEs, and the Gold directory lists each one with its fix status.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2025-2494 patched?
The record names no fixed version. Check the INCIBE notice and contact Sytel.
Why does a login-protected endpoint score 9.8?
The vector lists no privileges required. The description says the endpoint sits behind basic authentication, so check the notice for how that gate can be passed, and use strong credentials either way.
Sources
- Safeguard Gold entry for CVE-2025-2494
- NVD record data for CVE-2025-2494 (published 2025-03-18)
- INCIBE notice on Softdial Contact Center (listed in the record, could not be retrieved)
Last reviewed: 19 October 2026.
