CVE-2025-11914
📋 TL;DR
This CVE describes a path traversal vulnerability in Shenzhen Ruiming Technology's Streamax Crocus system version 1.3.40. Attackers can manipulate the FilePath parameter in the /DeviceFileReport.do?Action=Download endpoint to access arbitrary files on the server. The vulnerability affects systems running the vulnerable version and can be exploited remotely.
💻 Affected Systems
- Shenzhen Ruiming Technology Streamax Crocus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through sensitive file disclosure (configuration files, credentials, system files) leading to further attacks.
Likely Case
Unauthorized access to sensitive files containing configuration data, logs, or credentials stored on the server.
If Mitigated
Limited impact with proper file system permissions and network segmentation preventing access to critical files.
🎯 Exploit Status
The exploit has been made public according to the description. Attack requires knowledge of file paths but is straightforward to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None provided
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side validation to restrict FilePath parameter to allowed directories and prevent directory traversal sequences.
Web Application Firewall Rules
allConfigure WAF to block requests containing directory traversal patterns (../, ..\, etc.) in the FilePath parameter.
🧯 If You Can't Patch
- Restrict network access to the vulnerable endpoint using firewall rules or network segmentation.
- Implement strict file system permissions to limit what files the web application can access.
🔍 How to Verify
Check if Vulnerable:
Test by accessing /DeviceFileReport.do?Action=Download with a FilePath parameter containing directory traversal sequences (e.g., ../../../etc/passwd).Check Version:
Check system documentation or web interface for version information. The exact command depends on system implementation.Verify Fix Applied:
Verify that directory traversal attempts return error messages or are blocked, and only valid file paths within allowed directories are processed.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /DeviceFileReport.do?Action=Download with FilePath containing ../ or similar traversal patterns
- Unusual file access patterns from web server process
Network Indicators:
- HTTP requests with suspicious FilePath parameters attempting to access system files
SIEM Query:
web.url:*DeviceFileReport.do* AND (web.param.FilePath:*../* OR web.param.FilePath:*..\*)