H3C CVM, the Cloud Virtualization Management component of the H3C CAS platform, has a critical unauthenticated file upload vulnerability tracked as CVE-2023-54405. The /cas/fileUpload/upload endpoint accepts file uploads without any authentication, and the token parameter is vulnerable to path traversal. Exploitation evidence was first recorded by the Shadowserver Foundation on October 14, 2023, which means this has been actively abused in the wild.

Let's be direct about what failed here. There are two distinct control breakdowns. First, a sensitive file upload endpoint was exposed with zero authentication required. That's not a misconfiguration you stumble into; that's a design decision someone made and nobody caught in review. Second, the server accepted user-controlled path input in the token parameter without sanitization, allowing an attacker to place a malicious JSP file into a web-accessible directory and then simply request it to get code execution as the web server process. No credentials. No privilege escalation required.

For IAM practitioners, the relevant question is what the web server identity looks like in your environment. If CAS or similar management platforms run under an overprivileged service account, an unauthenticated RCE lands the attacker with whatever that account can touch: virtualization management APIs, adjacent systems, secrets cached on disk. This is exactly the scenario where service account scoping and least-privilege enforcement matter most. A compromise of the web server user should be a containment event, not a pivot point into your whole cloud infrastructure.

Cloud management planes are high-value targets. They tend to run with elevated privileges, they're often on internal networks that teams assume provide implicit protection, and their administrative endpoints frequently get missed in external-facing security reviews. If you're running H3C CAS in any capacity, you need to treat this as active exploitation risk, not a theoretical one.

If you run H3C CAS, patch or isolate the CVM component immediately and check your web server logs for unexpected requests to /cas/fileUpload/upload going back to at least October 2023. Beyond that, audit the service account running your cloud management plane: it should not have rights beyond what CVM itself needs to function. If you can't patch right now, put a WAF rule or network control in front of that endpoint to block unauthenticated access while you work through the change process.