VulnerabilityModified
CVE-2016-10106
Directory traversal vulnerability in scgi-bin/platform.cgi on NETGEAR FVS336Gv3, FVS318N, FVS318Gv2, and SRX5308 devices with firmware before 4.3.3-8 allows remote authenticated users to read arbitrary files via a ..
MEDIUM 6.5EPSS 2.43%
Does this matter?
Lower severity and a low EPSS score (2.43%). Track it; it rarely justifies an emergency change on its own.
Description
Directory traversal vulnerability in scgi-bin/platform.cgi on NETGEAR FVS336Gv3, FVS318N, FVS318Gv2, and SRX5308 devices with firmware before 4.3.3-8 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the thispage parameter, as demonstrated by reading the /etc/shadow file.
- CVSS 3.0
- 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 2.43% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- netgear/fvs336gv3 firmware · netgear/srx5308 firmware · netgear/fvs318gv2 firmware · netgear/fvs318n firmware
- Source
- cve@mitre.org
References
- http://kb.netgear.com/30739/Path-Traversal-Attack-Security-VulnerabilityPatch, Vendor Advisory
- http://www.securityfocus.com/bid/95204
- http://www.securitytracker.com/id/1037548
- https://twitter.com/mantislesin/status/816618162770821120
- http://kb.netgear.com/30739/Path-Traversal-Attack-Security-VulnerabilityPatch, Vendor Advisory
- http://www.securityfocus.com/bid/95204
- http://www.securitytracker.com/id/1037548
- https://twitter.com/mantislesin/status/816618162770821120
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.