CVE Published: 24/10/2024 |
CVE Updated: 25/10/2024 |
CVE Year: 2024 Source: SEC-VLab |
Vendor: Lawo AG |
Product: vsm LTC Time Sync (vTimeSync) Status : PUBLISHED
CVE-2024-6049 Description
The web server of Lawo AG vsm LTC Time Sync (vTimeSync) is affected by a "..." (triple dot) path traversal vulnerability. By sending a specially crafted HTTP request, an unauthenticated remote attacker could download arbitrary files from the operating system. As a limitation, the exploitation is only possible if the requested file has some file extension, e. g. .exe or .txt.