CVE-2024-40088
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System versions up to 5.16.1.33 allows remote, unauthenticated attackers to enumerate the existence and length of any file in the filesystem by placing malicious payloads in the path of any HTTP request.
Risk Assessment
An attacker can gather information about the filesystem structure, potentially facilitating further attacks such as data exfiltration or privilege escalation.
Recommendation
Immediately update the firmware of the Vilo 5 Mesh WiFi System to a version newer than 5.16.1.33 that includes a fix for this vulnerability.
Original NVD description (English source)
A Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to enumerate the existence and length of any file in the filesystem by placing malicious payloads in the path of any HTTP request.