Malicious file upload via extension-content mismatch

Unrestricted file upload in Akuvox E11 111.30.2.19 and earlier allows remote authenticated users to write malicious files. The upload handler trusts an accepted filename extension without verifying that it matches the supplied file content, so renamed malicious files pass validation. Authentication to a network-reachable upload interface is required; exploitation writes attacker-supplied content to the device without a documented execution path.