CVE-2024-40088
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System versions up to 5.16.1.33 allows remote, unauthenticated attackers to enumerate the existence and length of any file in the filesystem by placing malicious payloads in the path of any HTTP request.
Risk Assessment
An attacker can gather information about the filesystem structure, potentially facilitating further attacks such as data exfiltration or privilege escalation.
Recommendation
Immediately update the firmware of the Vilo 5 Mesh WiFi System to a version newer than 5.16.1.33 that includes a fix for this vulnerability.
Other vulnerabilities in Boa webserver
See all- CVE-2016-9564High
Buffer overflow in send_redirect() in Boa Webserver 0.92r allows remote attackers to perform a DoS attack via an HTTP GET request with a long URI consisting only of '/' and '.' characters.
- CVE-2024-40084Critical
In the Vilo 5 Mesh WiFi system version 5.16.1.33 and earlier, the Boa webserver contains a buffer overflow vulnerability. A remote, unauthenticated attacker can exploit exceptionally long HTTP methods or paths to execute arbitrary code.
Original NVD description (English source)
A Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to enumerate the existence and length of any file in the filesystem by placing malicious payloads in the path of any HTTP request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS