CVE-2021-23241

Name of the Vulnerable Software and Affected Versions MERCUSYS Mercury X18G version 1.0.5

Description The issue allows Directory Traversal via ../ in conjunction with a loginLess or login.htm URI to the web server, enabling authentication bypass. This is demonstrated by the /loginLess/../../etc/passwd URI, which showcases the vulnerability.

Recommendations For MERCUSYS Mercury X18G version 1.0.5, consider restricting access to the loginLess and login.htm URIs as a temporary workaround until a patch is available. Additionally, avoid using the ../ sequence in conjunction with these URIs to minimize the risk of exploitation.