Authenticated file disclosure via unchecked absolute paths
Published Dec 24, 2025 · Updated Dec 24, 2025
Path traversal in BEWARD N100 firmware M2.1.6.04C014 allows remote authenticated users to read arbitrary system files over HTTP. The cgi-bin/operator/fileread handler uses the READ.filePath value to read files without validating or restricting absolute paths. Access to the authenticated operator interface is required, and successful requests disclose files such as /etc/passwd and /etc/issue without modifying them.
Summary
What happened
Path traversal in BEWARD N100 firmware M2.1.6.04C014 allows remote authenticated users to read arbitrary system files over HTTP. The cgi-bin/operator/fileread handler uses the READ.filePath value to read files without validating or restricting absolute paths. Access to the authenticated operator interface is required, and successful requests disclose files such as /etc/passwd and /etc/issue without modifying them.
The record
- CVE
- CVE-2019-25246
- Published
- Dec 24, 2025
- Updated
- Dec 24, 2025
- Vendor
- BEWARD
- Product
- N100
- Classifications
- CWE-22, T1005
- Attack vector
- network
- Privileges
- authenticated
Timeline
How it unfolded
- Dec 24, 2025CVE publishedPublication date reported by the CVE source.
- Dec 24, 2025Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=M2.1.6.04C014
What conditions does exploitation require?
What is affected?
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
- Exploit-DB 46320 proof of conceptfunctional · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo