CVE-2024-1303

MEDIUM

Badger Meter Monitool < 4.7 - Authenticated Path Traversal via Download-File Functionality

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-1303. PoCs published by guillermogm4.

AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2024-1303, a path traversal vulnerability in Badgermeter moni:tool version 4.6.3. It includes a proof-of-concept demonstration showing how an authenticated attacker can exploit the 'names' parameter in the 'export-autofiles-download.x' endpoint to retrieve arbitrary files, such as '/etc/passwd'.

Description

Incorrectly limiting the path to a restricted directory vulnerability in Badger Meter Monitool that affects versions up to 4.6.3 and earlier. This vulnerability allows an authenticated attacker to retrieve any file from the device using the download-file functionality.

Exploits (1)

nomisec WRITEUP
by guillermogm4 · poc
https://github.com/guillermogm4/CVE-2024-1303---Badgermeter-moni-tool-Path-Traversal

This repository provides a detailed technical analysis of CVE-2024-1303, a path traversal vulnerability in Badgermeter moni:tool version 4.6.3. It includes a proof-of-concept demonstration showing how an authenticated attacker can exploit the 'names' parameter in the 'export-autofiles-download.x' endpoint to retrieve arbitrary files, such as '/etc/passwd'.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Badgermeter moni:tool version 4.6.3
Auth required
Prerequisites: Authenticated access to the application · Network access to the vulnerable endpoint
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 6.5
EPSS 0.0104
EPSS Percentile 59.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (1)
badgermeter/monitool < 4.7
Published Mar 12, 2024
Tracked Since Feb 18, 2026