CVE-2017-9097
CriticalSummary
In devices using Anti-Web software up to version 3.8.7, an LFI vulnerability allows a remote attacker to read or modify files through a path traversal technique. This is exemplified by the ability to read the password file or write to an arbitrary file using the template parameter in cgi-bin/write.cgi.
Risk Assessment
This vulnerability poses a serious security risk, allowing attackers access to sensitive data and the ability to modify it, potentially leading to further attacks on the system.
Recommendation
It is recommended to update the software to the latest version to eliminate this vulnerability and implement appropriate security measures, such as monitoring file access.
Original NVD description (English source)
In Anti-Web through 3.8.7, as used on NetBiter FGW200 devices through 3.21.2, WS100 devices through 3.30.5, EC150 devices through 1.40.0, WS200 devices through 3.30.4, EC250 devices through 1.40.0, and other products, an LFI vulnerability allows a remote attacker to read or modify files through a path traversal technique, as demonstrated by reading the password file, or using the template parameter to cgi-bin/write.cgi to write to an arbitrary file.