CVE-2022-47526

CRITICAL

Fox-IT DataDiode 3.4.3 - Path Traversal and Arbitrary File Write

Title source: llm

Description

Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a path traversal vulnerability with resultant arbitrary writing of files. A remote attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the downstream node user. Exploitation of this issue does not require user interaction.

References (2)

Core 2

Core References

Product

https://www.fox-it.com/nl-en/fox-crypto/fox-datadiode/

Product

https://www.fox-it.com/nl-en/software-vulnerability-report/

Scores

CVSS v3 9.8

EPSS 0.0130

EPSS Percentile 66.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-22

Status published

Products (1)

fox-it/fox_datadiode_firmware 3.4.3

Published May 31, 2023

Tracked Since Feb 18, 2026