Vulnerability · Published Oct 24, 2024 · Assigned by SEC-VLab

CVE-2024-6049Unauthenticated Path Traversal

High 7.5

In plain English

A high-severity security flaw in vsm LTC Time Sync (vTimeSync) from Lawo AG. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.2% (higher than 91% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)4.2%top 8.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

The web server of Lawo AG vsm LTC Time Sync (vTimeSync) is affected by a "..." (triple dot) path traversal vulnerability. By sending a specially crafted HTTP request, an unauthenticated remote attacker could download arbitrary files from the operating system. As a limitation, the exploitation is only possible if the requested file has some file extension, e. g. .exe or .txt.

Affected products (as reported)

Vendor	Product	Versions
Lawo AG	vsm LTC Time Sync (vTimeSync)	see references

Weakness: CWE-32 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://r.sec-consult.com/lawo third-party-advisory
https://lawo.com/lawo-downloads/ patch
http://seclists.org/fulldisclosure/2024/Oct/7