Hello and welcome to the Tuesday, October 14th, 2025 edition of the Sands Internet Storm Centers.

Stormcast, my name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the sands.edu bachelor's decree program in

applied cyber security. Nothing too exciting in diaries today. I wrote up a tag scans that we

have seen for e-safnet CDG. That is a document security management system.

Appears to mostly target the Chinese market.

It's Chinese maker of the software and their website and such is pretty much Chinese only.

So I assume that that's where they're focusing their marketing effort at.

There have been a number of different vulnerabilities,

including a cross-sat scripting issue

that in particular sort of effect at that system config endpoint

that we do see probed.

There have been prior vulnerabilities like C4 injection vulnerabilities.

So a little bit difficult to tell what exactly they're trying to exploit here, in particular

for the request that I've seen so far, we don't actually have to request body.

Only some of our honeypots report that.

And the ones that have been exposed to these scans happened to not have reported the request body.

Other than that, as any of these electronic document security management systems

or secure document management systems,

well, don't assume they're secure.

I talked about this many times before and tried to limit

the exposure of any documents stored in these systems.

...