Description
The web server of Lawo AG vsm LTC Time Sync (vTimeSync) is affected by a "..." (triple dot) path traversal vulnerability. By sending a specially crafted HTTP request, an unauthenticated remote attacker could download arbitrary files from the operating system. As a limitation, the exploitation is only possible if the requested file has some file extension, e. g. .exe or .txt.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Lawo | vsm LTC Time Sync (vTimeSync) | — | 4.5.6.0 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Lawo AG vsm LTC Time Sync (vTimeSync) - Path Traversal http/cves/2024/CVE-2024-6049.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://r.sec-consult.com/lawo third-party-advisory
- https://lawo.com/lawo-downloads/ patch