{"id":"CVE-2012-4027","url":"https://www.cyber-defence.io/tools/cve/CVE-2012-4027","generatedAt":"2026-10-27T17:57:01.562Z","title":"Directory traversal vulnerability in Tridium Niagara AX Framework allows remote attackers to read files outside of the intended images, nav, and px folders by leveraging incorrect permissions, as demonstrated by reading the config.bog file.","description":"Directory traversal vulnerability in Tridium Niagara AX Framework allows remote attackers to read files outside of the intended images, nav, and px folders by leveraging incorrect permissions, as demonstrated by reading the config.bog file.","published":"2012-07-16T20:55:05.000Z","lastModified":"2026-06-16T23:44:18.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":5,"severity":"MEDIUM","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N"},"cwe":["CWE-22"],"affected":["tridium/niagara ax"],"epss":{"score":0.02542,"percentile":0.84875,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (2.54%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://www.washingtonpost.com/investigations/tridiums-niagara-framework-marvel-of-connectivity-illustrates-new-cyber-risks/2012/07/11/gJQARJL6dW_story.html","tags":["Permissions Required"],"source":"cve@mitre.org"},{"url":"https://www.tridium.com/galleries/briefings/NiagaraAX_Framework_Software_Security_Alert.pdf","tags":["Broken Link","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://www.washingtonpost.com/investigations/tridiums-niagara-framework-marvel-of-connectivity-illustrates-new-cyber-risks/2012/07/11/gJQARJL6dW_story.html","tags":["Permissions Required"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.tridium.com/galleries/briefings/NiagaraAX_Framework_Software_Security_Alert.pdf","tags":["Broken Link","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-4027","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}