Sauter Modulo 6 and EY-Modulo 5 Directory Traversal Vulnerability in importFile SOAP Method

A directory traversal vulnerability has been identified in the importFile SOAP method of SAUTER modulo 6 devices and certain EY-modulo 5 devices. This vulnerability allows an unauthenticated remote attacker to bypass path restrictions and upload files to arbitrary locations on the affected device. The issue arises from improper validation of file paths, enabling exploitation through the web server API.

Impact

Exploitation of this vulnerability could lead to unauthorized file uploads, potentially overwriting critical system files or uploading malicious payloads that could be executed on the device.

Remediation

Users are advised to update to SAUTER modulo 6 embedded software version 3.2.0 or newer. For EY-modulo 5 devices, version 6.0 is recommended. This will require CASE Suite Version 5.2 SR5 or newer. Contact your local SAUTER representative for support.