Unauthenticated Path Traversal
36Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 7.5epss 4.2%
exploitation probability
4.2%top 9% of all CVEs
observed exploitation
nono source reports it
The web server of Lawo AG vsm LTC Time Sync (vTimeSync) is affected by a "..." (triple dot) path traversal vulnerability. By sending a specially crafted HTTP request, an unauthenticated remote attacker could download arbitrary files from the operating system. As a limitation, the exploitation is only possible if the requested file has some file extension, e. g. .exe or .txt.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Lawo AG · vsm LTC Time Sync (vTimeSync)