CVE-2017-16786: Infoleak
The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users with certain privileges to read arbitrary files via (1) the ntpclientcounterlogfile parameter to cgi-bin/mainv2 or (2) vectors involving curl support of the "file" schema in the firmware update functionality.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-16786?
CVE-2017-16786 is a vulnerability in Meinberg LANTIME devices with firmware before 6.24.004 that allows remote authenticated users to read arbitrary files.
How does CVE-2017-16786 affect Meinberg LANTIME devices?
CVE-2017-16786 affects Meinberg LANTIME devices with firmware before 6.24.004.
What is the severity of CVE-2017-16786?
CVE-2017-16786 has a severity rating of 6.5 (medium).
How can remote authenticated users exploit CVE-2017-16786?
Remote authenticated users can exploit CVE-2017-16786 by using certain privileges to read arbitrary files via the ntpclientcounterlogfile parameter or vectors involving curl support of the "file" schema.
Are there any fixes available for CVE-2017-16786?
Yes, upgrading to firmware version 6.24.004 or later will fix CVE-2017-16786.