CVE-2024-8685: Path-Traversal vulnerability in Revolution Pi
Published Feb 10, 2025
·Updated
Path-Traversal vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker to list device directories via the ‘/pictory/php/getFileList.php’ endpoint in the ‘dir’ parameter.
Affected Software
1 affected component
Kunbus Revolution Pi
Remediation
Information
The command injection vulnerability has been fixed by the KUNBUS team in the Revolution Pi webstatus 2.4.2 release. Path Traversal vulnerability has been fixed by the KUNBUS team in Revolution Pi pictory 2.1.1.
Event History
Feb 10, 2025
CVE Published
via MITRE·12:46 PM
Data Sourced
via MITRE·12:46 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-8685?
CVE-2024-8685 has been rated as a medium severity vulnerability.
2
How do I fix CVE-2024-8685?
To fix CVE-2024-8685, update to the latest version of Revolution Pi provided by KUNBUS GmbH.
3
What type of vulnerability is CVE-2024-8685?
CVE-2024-8685 is a path traversal vulnerability affecting the Revolution Pi product.
4
Who is affected by CVE-2024-8685?
CVE-2024-8685 affects users of Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH.
5
How can an attacker exploit CVE-2024-8685?
An attacker can exploit CVE-2024-8685 by using the '/pictory/php/getFileList.php' endpoint to list device directories.