Siemens Apogee Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

2019-11-0800:00:00

www.tenable.com

0.004 Low

EPSS

Percentile

74.1%

JSON

A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. A directory traversal vulnerability could allow a remote attacker with network access to the integrated web server (80/tcp and 443/tcp) to obtain information on the structure of the file system of the affected devices.

File data ot_500105.nasl

VendorProductVersionCPE
siemensapogee_pxc_bacnet_automation_controller_firmware*cpe:2.3:o:siemens:apogee_pxc_bacnet_automation_controller_firmware:*:*:*:*:*:*:*:*
siemensapogee_pxc_bacnet_automation_controller-cpe:2.3:h:siemens:apogee_pxc_bacnet_automation_controller:-:*:*:*:*:*:*:*
siemensapogee_pxc_bacnet_automation_controller_firmware*cpe:2.3:o:siemens:apogee_pxc_bacnet_automation_controller_firmware:*:*:*:*:*:*:*:*
siemenstalon_tc_bacnet_automation_controller-cpe:2.3:h:siemens:talon_tc_bacnet_automation_controller:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	apogee_pxc_bacnet_automation_controller_firmware	*	cpe:2.3:o:siemens:apogee_pxc_bacnet_automation_controller_firmware::::::::
siemens	apogee_pxc_bacnet_automation_controller	-	cpe:2.3:h:siemens:apogee_pxc_bacnet_automation_controller:-:::::::*
siemens	apogee_pxc_bacnet_automation_controller_firmware	*	cpe:2.3:o:siemens:apogee_pxc_bacnet_automation_controller_firmware::::::::
siemens	talon_tc_bacnet_automation_controller	-	cpe:2.3:h:siemens:talon_tc_bacnet_automation_controller:-:::::::*