CVE-2017-7237
CriticalSummary
The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spiceworks data/configurations directory. It leverages the unauthenticated nature of the TFTP service for all clients who can reach UDP port 69.
Risk Assessment
Attackers can gain access to sensitive data and configurations, potentially leading to further attacks on the organization's systems.
Recommendation
It is recommended to block access to UDP port 69 and implement authentication for the TFTP service to mitigate the risk of unauthorized access.
Original NVD description (English source)
The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spiceworks data\configurations directory by leveraging the unauthenticated nature of the TFTP service for all clients who can reach UDP port 69, as demonstrated by a WRQ (aka Write request) operation for a configuration file or an executable file.