ZwickRoell Test Data Management Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in ZwickRoell Test Data Management versions prior to 3.0.8. The issue resides in the /server/node_upgrade_srv.js endpoint, where an unauthenticated attacker can exploit directory traversal sequences via the firmware parameter. This exploitation allows access to arbitrary files on the server, potentially disclosing sensitive system information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive system files on the server.