VAR-201401-0706

Vulnerability from variot - Updated: 2025-08-02 23:17

A path traversal vulnerability exists in A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier. The vulnerability resides in the handling of the filename parameter in the /xml/downloads endpoint, which fails to properly sanitize user input. An unauthenticated attacker can exploit this flaw by sending crafted HTTP requests containing directory traversal sequences to read arbitrary files outside the intended directory. The files returned by the vulnerable endpoint are deleted from the system after retrieval. This can lead to unauthorized disclosure of sensitive information such as SSL certificates and private keys, as well as unintended file deletion. The A10 Networks AX ADC failed to properly process the 'filename' parameter data, allowing remote attackers to exploit the vulnerability to submit a special directory traversal sequence to view system file content with WEB privileges. A10 Networks AX ADC is an application delivery controller from A10 Networks. An attacker could use this loophole to traverse characters ('..') to access arbitrary files containing sensitive information. Information harvested may aid in launching further attacks

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201401-0706",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "networks ax adc build",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "a10",
        "version": "2.7.0217"
      },
      {
        "model": "networks ax adc build",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "a10",
        "version": "2.7217"
      },
      {
        "model": "networks ax adc gr1-p5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "a10",
        "version": "2.6.1"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-00908"
      },
      {
        "db": "BID",
        "id": "65206"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "xistence",
    "sources": [
      {
        "db": "BID",
        "id": "65206"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-381"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2014-125125",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2014-00908",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "disclosure@vulncheck.com",
            "id": "CVE-2014-125125",
            "trust": 1.0,
            "value": "High"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2014-00908",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-00908"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-125125"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A path traversal vulnerability exists in A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier. The vulnerability resides in the handling of the filename parameter in the /xml/downloads endpoint, which fails to properly sanitize user input. An unauthenticated attacker can exploit this flaw by sending crafted HTTP requests containing directory traversal sequences to read arbitrary files outside the intended directory. The files returned by the vulnerable endpoint are deleted from the system after retrieval. This can lead to unauthorized disclosure of sensitive information such as SSL certificates and private keys, as well as unintended file deletion. The A10 Networks AX ADC failed to properly process the \u0027filename\u0027 parameter data, allowing remote attackers to exploit the vulnerability to submit a special directory traversal sequence to view system file content with WEB privileges. A10 Networks AX ADC is an application delivery controller from A10 Networks. An attacker could use this loophole to traverse characters (\u0027..\u0027) to access arbitrary files containing sensitive information. Information harvested may aid in launching further attacks",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-125125"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-00908"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-381"
      },
      {
        "db": "BID",
        "id": "65206"
      }
    ],
    "trust": 2.25
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "EXPLOIT-DB",
        "id": "31261",
        "trust": 1.6
      },
      {
        "db": "BID",
        "id": "65206",
        "trust": 1.5
      },
      {
        "db": "NVD",
        "id": "CVE-2014-125125",
        "trust": 1.0
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-00908",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-381",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-00908"
      },
      {
        "db": "BID",
        "id": "65206"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-381"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-125125"
      }
    ]
  },
  "id": "VAR-201401-0706",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-00908"
      }
    ],
    "trust": 1.35
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-00908"
      }
    ]
  },
  "last_update_date": "2025-08-02T23:17:00.775000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "A10 Networks AX ADC \u0027filename\u0027 parameter directory traversal vulnerability patch",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/43542"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-00908"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-22",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-706",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-125125"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.0,
        "url": "https://www.exploit-db.com/exploits/31261"
      },
      {
        "trust": 1.0,
        "url": "https://www.vulncheck.com/advisories/a10-networks-ax-loadbalancer-path-traversal"
      },
      {
        "trust": 1.0,
        "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/a10networks_ax_directory_traversal.rb"
      },
      {
        "trust": 0.6,
        "url": "http://www.exploit-db.com/exploits/31261/"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/bid/65206"
      },
      {
        "trust": 0.3,
        "url": "http://www.a10networks.com/products/axseries_adc.php"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-00908"
      },
      {
        "db": "BID",
        "id": "65206"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-381"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-125125"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-00908"
      },
      {
        "db": "BID",
        "id": "65206"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-381"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-125125"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-02-14T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2014-00908"
      },
      {
        "date": "2014-01-28T00:00:00",
        "db": "BID",
        "id": "65206"
      },
      {
        "date": "2014-01-28T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201402-381"
      },
      {
        "date": "2025-07-31T15:15:35.063000",
        "db": "NVD",
        "id": "CVE-2014-125125"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-02-14T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2014-00908"
      },
      {
        "date": "2014-01-28T00:00:00",
        "db": "BID",
        "id": "65206"
      },
      {
        "date": "2014-02-28T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201402-381"
      },
      {
        "date": "2025-07-31T18:42:37.870000",
        "db": "NVD",
        "id": "CVE-2014-125125"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-381"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A10 Networks AX ADC \u0027filename\u0027 Parameter Directory Traversal Vulnerability",
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-00908"
      },
      {
        "db": "BID",
        "id": "65206"
      }
    ],
    "trust": 0.9
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "path traversal",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-381"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.