cve-2021-28149

{
  "cvss": 0.0,
  "datePublished": "2021-10-07T00:00:00Z",
  "dateUpdated": "2021-10-07T00:00:00Z",
  "description": "Hongdian H8922 3.0.5 devices allow Directory Traversal. The /log_download.cgi log export handler does not validate user input and allows a remote attacker with minimal privileges to download any file from the device by substituting ../ (e.g., ../../etc/passwd) This can be carried out with a web browser by changing the file name accordingly. Upon visiting log_download.cgi?type=../../etc/passwd and logging in, the web server will allow a download of the contents of the /etc/passwd file.",
  "dueDate": "",
  "id": "CVE-2021-28149",
  "kev_catalogs": [
    "vulncheck"
  ],
  "knownRansomwareCampaignUse": "Unknown",
  "product": "h8922",
  "requiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
  "severity": "HIGH",
  "source": "vulncheck_kev",
  "title": "hongdian h8922 Improper Limitation of a Pathname to a Restricted Directory",
  "vendor": "hongdian"
}