CVE-2026-29522

HIGH EPSS 57.2%

Published Mar 16, 20263mo ago · Modified Jun 17, 20262w ago

8.7 CVSS 4.0

High

Published Mar 16, 2026 3mo ago

Last Modified Jun 17, 2026 2w ago

Description

ZwickRoell Test Data Management versions prior to 3.0.8 contain a local file inclusion (LFI) vulnerability in the /server/node_upgrade_srv.js endpoint. An unauthenticated attacker can supply directory traversal sequences via the firmware parameter to access arbitrary files on the server, leading to information disclosure of sensitive system files.

CVSS Details

Base Score

8.7

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope X

Threat Intelligence

EPSS Exploit Probability

57.2% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

References 2

vulncheck.com https://www.vulncheck.com/advisories/zwickroell-test-data-management-path-traversal-lfi
zwickroell.com https://www.zwickroell.com/accessories/testxpert-testing-software/test-data-management/

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.