CVE-2021-44124

Katalog CVE

CVSS 7.5 · High EPSS 1,9%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada hiby r3 pro firmware. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Hiby Music Hiby OS R3 Pro 1.5 and 1.6 is vulnerable to Directory Traversal. The HTTP Server does not have enough input data sanitization when shown data from SD Card, an attacker can navigate through the device's File System over HTTP.

Rincian

Terbit di NVD

28 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 78,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/feric/Findings/tree/main/Hiby/Web%20Server/Path%20Traversal exploit · advisory pihak ketiga
• https://github.com/vext01/hiby-issues/issues/9#issuecomment-907891626 exploit · advisory pihak ketiga