CVE-2019-17224
MEDIUM EPSS 65.1%
Published Oct 28, 20196y ago · Modified Jun 17, 20262w ago
5.3 CVSS 3.1
Published Oct 28, 2019 6y ago
Last Modified Jun 17, 2026 2w ago
Description
The web interface of the Compal Broadband CH7465LG modem (version CH7465LG-NCIP-6.12.18.25-2p6-NOSH) is vulnerable to a /%2f/ path traversal attack, which can be exploited in order to test for the existence of a file pathname outside of the web root directory. If a file exists but is not part of the product, there is a 404 error. If a file does not exist, there is a 302 redirect to index.html.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None
Threat Intelligence
EPSS Exploit Probability
65.1% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available
Weaknesses 1
CWE-22 Path Traversal Resource Mgmt
Affected Products 2
References 2
- vulnerabilities.home.blog https://vulnerabilities.home.blog/2019/10/27/again-a-vunerability-in-cable-router-ch7465lg-cve-2019-17224/
- search-lab.hu https://www.search-lab.hu/media/Compal_CH7465LG_Evaluation_Report_1.1.pdf
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.