critical9.8Public exploit code
CVE-2024-25830
F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- DataCube3 v1.0 - Unrestricted file upload 'RCE'2024-03-10 · webapps · php
Impact
F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this, by sending a URI that contains the path of the configuration file. A successful exploit could allow the attacker to extract the root and admin password.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| F-Logic | Datacube3 Firmware | Version 1.0 |