Directory Traversal Vulnerability in Service with Basic Authentication on Target Device

CVE-2025-27025

What is CVE-2025-27025?

The target device is vulnerable due to a misconfigured service that exposes a TCP endpoint secured only by Basic Authentication. The vulnerability arises from the ability to use the PUT method to write files directly to the device's file system, with the potential to write in any directory, including system-level directories, given root-level permissions. Furthermore, attackers can employ the GET method in tandem with a Directory Traversal technique to read sensitive files located anywhere on the device. Utilizing tools like Postman, an attacker can easily exploit this vulnerability, compromising the integrity and confidentiality of the system.

References