CVE-2014-125125: A10 Networks AX Loadbalancer Path Traversal
A path traversal vulnerability exists in A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier. The vulnerability resides in the handling of the filename parameter in the /xml/downloads endpoint, which fails to properly sanitize user input. An unauthenticated attacker can exploit this flaw by sending crafted HTTP requests containing directory traversal sequences to read arbitrary files outside the intended directory. The files returned by the vulnerable endpoint are deleted from the system after retrieval. This can lead to unauthorized disclosure of sensitive information such as SSL certificates and private keys, as well as unintended file deletion.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-125125?
CVE-2014-125125 is classified as a high-severity path traversal vulnerability.
How do I fix CVE-2014-125125?
To fix CVE-2014-125125, upgrade to A10 Networks AX Loadbalancer version 2.6.1-GR1-P6 or 2.7.1 or later.
What systems are affected by CVE-2014-125125?
CVE-2014-125125 affects A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier.
What can an attacker do with CVE-2014-125125?
An attacker exploiting CVE-2014-125125 can access sensitive files on the server through improper input handling.
Is authentication required to exploit CVE-2014-125125?
No, CVE-2014-125125 can be exploited by unauthenticated attackers.