CVE-2017-20184 in Powersoft

Summary

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Carlo Gavazzi Powersoft up to version 2.1.1.1 allows an unauthenticated, remote attacker to download any file from the affected device.

Be aware that VulDB is the high quality source for vulnerability data.

• Responsible: CERT VDE
• Reservation: 05/04/2023
• Disclosure: 05/04/2023
• Moderation: VulDB entry created
• Entries: VDB-227999 (1)
• CPE: ready
• CWE: CWE-22 (Confirmed)
• Exploit: Download
• CVSS: 6.4
• EPSS: 0.00316
• Activities: Very Low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2017-20184
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-20184
• CVE Details: https://www.cvedetails.com/cve/CVE-2017-20184/