CVE-2009-1730

Netmechanica Netdecision Tftp Server - Path Traversal

Title source: rule

Description

Multiple directory traversal vulnerabilities in NetMechanica NetDecision TFTP Server 4.2 allow remote attackers to read or modify arbitrary files via directory traversal sequences in the (1) GET or (2) PUT command.

Exploits (3)

exploitdb WORKING POC VERIFIED

by Metasploit · rubyremotewindows

https://www.exploit-db.com/exploits/20392

View Code ZIP pw:eip

metasploit WORKING POC

by Rob Kraus, juan vazquez · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/tftp/netdecision_tftp.rb

View Code ZIP pw:eip

metasploit WORKING POC EXCELLENT

by Rob Kraus, juan vazquez · rubypocwin

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/tftp/netdecision_tftp_traversal.rb

View Code ZIP pw:eip

References (4)

[Vendor Advisory] http://secunia.com/advisories/35131

[URL Repurposed] http://www.princeofnigeria.org/blogs/index.php/2009/05/17/netdecision-tftp-server-4-2-tftp-directo?blog=1

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/50574

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/35002

Scores

EPSS 0.7527

EPSS Percentile 98.9%

Details

CWE

CWE-22

Status published

Products (1)

netmechanica/netdecision_tftp_server 4.2

Published May 20, 2009

Tracked Since Feb 18, 2026