---
id: 3745
title: "ZendTo NDay Vulnerability Hunting - Unauthenticated RCE in v5.24-3 <= v6.10-4"
source_domain: projectblack.io
source_url: "https://projectblack.io/blog/zendto-nday-vulnerabilities/"
published_at: "2025-03-30 23:22"
tags: ["cloud", "rce", "unauthenticated", "type-juggling", "zendto", "nday"]
phying_url: "https://phying.com/item/3745"
lang: en
---

# ZendTo NDay Vulnerability Hunting - Unauthenticated RCE in v5.24-3 <= v6.10-4

## Summary

NDay research on ZendTo: an unsanitised tmp_name field gives unauthenticated RCE in v5.24-3 through v6.10-4, plus an MD5 type-juggling auth bypass. Many exposed instances remain unpatched.

## Intelligence Metadata

- **Sources:** projectblack.io
- **Published:** 2025-03-30 23:22
- **Original:** https://projectblack.io/blog/zendto-nday-vulnerabilities/
- **Phying News:** https://phying.com/item/3745