Netgear SPH200D <= 1.0.4.80 Path Traversal via HTTP GET
Vulnerability Description
A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions <= 1.0.4.80 in its embedded web server. Authenticated attackers can exploit crafted GET requests to access arbitrary files outside the web root by injecting traversal sequences. This can expose sensitive system files and configuration data.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2013-10063
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Michael Messner
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/netgear_sph200d_traversal.rb
- https://www.exploit-db.com/exploits/24441
- https://web.archive.org/web/20130207034706/http://www.s3cur1ty.de/m1adv2013-002
- https://www.vulncheck.com/advisories/netgear-sph200d-path-traversal-via-http-get
More from Netgear
View All →Affected Vendor
Netgear
View all reports →