CVE-2013-10063
MEDIUMNetgear SPH200D Skype phone firmware <=1.0.4.80 - Path Traversal
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2013-10063.
PoCs published by m-1-k-3, including Metasploit module auxiliary/scanner/http/netgear_sph200d_traversal.
AI-analyzed exploit summary This advisory details multiple vulnerabilities in Netgear SPH200D firmware 1.0.4.80, including directory traversal, password change without authentication, local path disclosure, and reflected XSS. The writeup provides proof-of-concept requests and responses but does not include executable exploit code.
Description
A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions <= 1.0.4.80 in its embedded web server. Authenticated attackers can exploit crafted GET requests to access arbitrary files outside the web root by injecting traversal sequences. This can expose sensitive system files and configuration data.
Exploits (2)
This advisory details multiple vulnerabilities in Netgear SPH200D firmware 1.0.4.80, including directory traversal, password change without authentication, local path disclosure, and reflected XSS. The writeup provides proof-of-concept requests and responses but does not include executable exploit code.
This Metasploit module exploits a directory traversal vulnerability in Netgear SPH200D Skype telephone devices. It attempts to access sensitive files via traversal sequences and downloads them if successful.
References (4)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N