CVE-2025-34047
Awaiting Analysis Awaiting Analysis - Queue
BaseFortify

Publication date: 2025-06-26

Last updated on: 2025-12-23

Assigner: VulnCheck

Description
A path traversal vulnerability exists in the Leadsec SSL VPN (formerly Lenovo NetGuard), allowing unauthenticated attackers to read arbitrary files on the underlying system via the ostype parameter in the /vpn/user/download/client endpoint. This flaw arises from insufficient input sanitation, enabling traversal sequencesΒ to escape the intended directory and access sensitive files.Β Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-06-26
Last Modified
2025-12-23
Generated
2026-05-07
AI Q&A
2025-06-26
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a path traversal flaw in the Leadsec SSL VPN that allows unauthenticated attackers to read arbitrary files on the system by manipulating the ostype parameter in a specific endpoint. It occurs because the input is not properly sanitized, letting attackers escape the intended directory and access sensitive files. [1]


How can this vulnerability impact me? :

The vulnerability can lead to unauthorized disclosure of sensitive information by allowing attackers to read arbitrary files on the affected system remotely without authentication or user interaction. This can compromise confidentiality and potentially expose critical data. [1]


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart