CVE-2023-37607

Name of the Vulnerable Software and Affected Versions Automatic-Systems SOC FL9600 FastLine lego T04E00 (affected versions not specified)

Description The issue allows a remote attacker to obtain sensitive information via a directory traversal attack. This can be achieved by exploiting the csvServer.php endpoint with a specially crafted dir parameter containing a .. sequence. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the csvServer.php endpoint to minimize the risk of exploitation. Avoid using the dir parameter in the affected endpoint until the issue is resolved.