VulnerabilityDeferred

CVE-2024-6049

The web server of Lawo AG vsm LTC Time Sync (vTimeSync) is affected by a "..." (triple dot) path traversal vulnerability.

HIGH 7.5EPSS 4.23%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (4.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The web server of Lawo AG vsm LTC Time Sync (vTimeSync) is affected by a "..." (triple dot) path traversal vulnerability. By sending a specially crafted HTTP request, an unauthenticated remote attacker could download arbitrary files from the operating system. As a limitation, the exploitation is only possible if the requested file has some file extension, e. g. .exe or .txt.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 4.23% probability · 90th percentile
CISA KEV: Not listed
Weakness: CWE-32
Source: 551230f0-3615-47bd-b7cc-93e92e730bbf

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.