CVE-2023-37607

HighCVSS 7.5

Published: 03/01/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.37%

69th percentile - higher than 69% of all known CVEs

Summary

A Directory Traversal vulnerability was found in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00. A remote attacker can access sensitive information by manipulating the 'dir' parameter in csvServer.php.

Risk Assessment

An attacker can read arbitrary files on the server, including configuration files, passwords, or personal data, leading to sensitive information leakage and security breach.

Recommendation

Immediately update the software to the latest version or apply a security patch. If not possible, restrict access to csvServer.php to trusted IP addresses only.

Other vulnerabilities in Automatic Systems SOC FL9600 FirstLane

CVE-2023-37608High
An issue in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 reveals a hardcoded super admin account automaticsystems with password astech. A remote attacker can exploit this to obtain sensitive information.

Original NVD description (English source)

Directory Traversal in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information via csvServer.php?file= with a .. in the dir parameter.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS