Meinberg LANTIME Web Configuration Utility 6.16.008 Authentication Bypass
Posted on 13 December 2017
Title: Meinberg LANTIME Web Configuration Utility - Failure to Restrict URL Access Author: Jakub Palaczynski CVE: CVE-2017-16787 Exploit tested on: ================== Meinberg LANTIME Web Configuration Utility 6.16.008 Vulnerability affects: ====================== All LTOS6 firmware releases before 6.24.004 Vulnerability: ************** Failure to Restrict URL Access: =============================== Any user is able to read all files stored outside cgi-bin directory without authentication. This way it is possible to download firmware, statistics or diagnostics files that are stored in upload directory. Contact: ======== Jakub[dot]Palaczynski[at]gmail[dot]com
