CVE-2018-14942

Harmonic NSG 9000 devices allow remote authenticated users to conduct directory traversal attacks, as demonstrated by "POST /PY/EMULATION_GET_FILE" or "POST /PY/EMULATION_EXPORT" with FileName=../../../passwd in the POST data.

Score

CVSS 3.0 8.8 High

Status

Modified - cve@mitre.org

Published

2018-08-05

Last modified

2024-08-05

Weaknesses

CWE-22

Affected products

• Nsg 9000 Firmware (Harmonicinc)

References

• https://github.com/pudding2/NSG9000/blob/master/exp.txt