Smart eVision’s file acquisition function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication, access restricted paths to download and delete arbitrary system files to disrupt service.
References
| Link | Resource |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-6570-9c632-1.html | Third Party Advisory |
Configurations
History
28 Sep 2022, 23:44
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Lcnet
Lcnet smart Evision |
|
| CPE | cpe:2.3:a:lcnet:smart_evision:2022.02.21:*:*:*:*:*:*:* | |
| References | (MISC) https://www.twcert.org.tw/tw/cp-132-6570-9c632-1.html - Third Party Advisory | |
| CWE | CWE-22 |
28 Sep 2022, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-09-28 04:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-39033
Mitre link : CVE-2022-39033
CVE.ORG link : CVE-2022-39033
JSON object : View
Products Affected
lcnet
- smart_evision
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')