Digiever DS-2105 Pro Arbitrary File Read Vulnerability

A vulnerability allowing arbitrary file read has been identified in the Digiever DS-2105 Pro model, specifically in version 3.1.0.71-11. This issue arises in the access_device.cgi script, which is part of the device's CGI gateway. The vulnerability is present on devices that are no longer supported by the manufacturer.

Impact

Exploitation of this vulnerability allows authenticated users to read arbitrary files on the device.

Reproduction

To reproduce this vulnerability, an authenticated user must send a request to the access_device.cgi script via the CGI gateway. The request must include a crafted fileName parameter that specifies the path of the file to be read. This exploitation can be detected by TXOne networking products.