CVE-2026-57471
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A CWE-22 Path Traversal vulnerability was identified in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad version 0.11.0. A local unauthenticated attacker can read arbitrary files with the privileges of the RevPiPyLoad daemon, including sensitive configuration and credential material.
Risk Assessment
The risk includes the possibility of local reading of sensitive files, such as configuration and credentials, potentially leading to data confidentiality breach.
Recommendation
It is recommended to update RevPiPyLoad to the latest version and restrict access to the local management interface.
Original NVD description (English source)
Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to read arbitrary files with the privileges of the RevPiPyLoad daemon, including sensitive configuration and credential material, by sending crafted requests to the local management service.