Keysight Ixia Vision Product Family Path Traversal Vulnerability Allowing Remote Code Execution

A path traversal vulnerability has been identified in the Keysight Ixia Vision Product Family, specifically in version 6.3.1. This vulnerability allows remote code execution by users with privileged accounts, such as device administrators. The issue arises from improper limitations on file paths, which could be exploited in conjunction with the 'Upload' functionality to execute arbitrary scripts or potentially run uploaded binaries.

Impact

Exploitation of this vulnerability could lead to unauthorized remote code execution on the affected device.

Remediation

Keysight recommends that all users upgrade to version 6.7.0 or later. For more information about the Ixia Vision Product Family, visit the Ixia product support page. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA.