CVE-2025-65287 Details
Description
An unauthenticated directory traversal vulnerability in cgi-bin/upload.cgi in SNMP Web Pro 1.1 allows a remote attacker to read arbitrary files. The CGI concatenates the user-supplied params directly onto the base path (/var/www/files/userScript/) using memcpy + strcat without validation or canonicalization, enabling ../ sequences to escape the intended directory. The download branch also echoes the unsanitized params into Content-Disposition, introducing header-injection risk.
A directory traversal vulnerability has been identified in SNMP Web Pro version 1.1, specifically within the cgi-bin/upload.cgi script. This vulnerability allows unauthenticated remote attackers to read arbitrary files on the server. The issue arises because the CGI script concatenates user-supplied parameters directly to a base path without proper validation or sanitization, enabling attackers to manipulate the file path and access sensitive files. Additionally, the vulnerability introduces a header injection risk by echoing unsanitized parameters into the Content-Disposition header.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 15, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://damiri.fr/en/cve/CVE-2025-65287 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| cdpenergy snmp web pro firmware | 1.1 |
CPE
Remediation
| |
| cdpenergy snmp web pro | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 15, 2025 | CVE Modified | CISA-ADP |
| Dec 12, 2025 | Initial Analysis | [email protected] |
| Dec 10, 2025 | CVE Modified | CISA-ADP |
| Dec 9, 2025 | New CVE Received | [email protected] |