CVE-2018-16739

HIGH

ABUS TVIP Firmware - Unauthenticated Path Traversal and Arbitrary File Write via filewrite Endpoint

Title source: llm

Description

An issue was discovered on certain ABUS TVIP devices. Due to a path traversal in /opt/cgi/admin/filewrite, an attacker can write to files, and thus execute code arbitrarily with root privileges.

References (2)

Core 2

Core References

Exploit, Third Party Advisory

https://sec.maride.cc/posts/abus/

Third Party Advisory

https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erreichen

Scores

CVSS v3 8.8

EPSS 0.0103

EPSS Percentile 59.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-22

Status published

Products (47)

abus/tvip_10000_firmware

abus/tvip_10001_firmware

abus/tvip_10005_firmware

abus/tvip_10005a_firmware

abus/tvip_10005b_firmware

abus/tvip_10050_firmware

abus/tvip_10051_firmware

abus/tvip_10055a_firmware

abus/tvip_10055b_firmware

abus/tvip_10500_firmware

... and 37 more

Published Oct 26, 2023

Tracked Since Feb 18, 2026