CVE-2009-1730 : Multiple directory traversal vulnerabilities in NetMechanica NetDecision TFTP Se

Multiple directory traversal vulnerabilities in NetMechanica NetDecision TFTP Server 4.2 allow remote attackers to read or modify arbitrary files via directory traversal sequences in the (1) GET or (2) PUT command.

Published 2009-05-20 18:30:00

Updated 2017-08-17 01:30:29

Source MITRE

View at NVD, CVE.org

Vulnerability category: Directory traversal

Products affected by CVE-2009-1730

Netmechanica » Netdecision Tftp Server » Version: 4.2
cpe:2.3:a:netmechanica:netdecision_tftp_server:4.2:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2009-1730

EPSS FAQ

75.21%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 98 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2009-1730

NetDecision 4.2 TFTP Writable Directory Traversal Execution

Disclosure Date: 2009-05-16

First seen: 2020-04-26

exploit/windows/tftp/netdecision_tftp_traversal

This module exploits a vulnerability found in NetDecision 4.2 TFTP server. The software contains a directory traversal vulnerability that allows a remote attacker to write arbitrary file to the file system, which results in code execution under the context of user

More information
NetDecision 4.2 TFTP Directory Traversal

Disclosure Date: 2009-05-16

First seen: 2020-04-26

auxiliary/scanner/tftp/netdecision_tftp

This modules exploits a directory traversal vulnerability in NetDecision 4.2 TFTP service. Authors: - Rob Kraus - juan vazquez <juan.vazquez@metasploit.com>

More information

CVSS scores for CVE-2009-1730

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2009-1730

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2009-1730

http://www.securityfocus.com/bid/35002

NetDecision TFTP Server Directory Traversal Vulnerability
http://www.princeofnigeria.org/blogs/index.php/2009/05/17/netdecision-tftp-server-4-2-tftp-directo?blog=1
https://exchange.xforce.ibmcloud.com/vulnerabilities/50574

Jump to

Vulnerability Details : CVE-2009-1730