CVE-2025-5160
📋 TL;DR
A path traversal vulnerability in H3C SecCenter SMP-E1114P02 allows attackers to access arbitrary files on the system by manipulating the 'Name' parameter in the /packetCaptureStrategy/download endpoint. This affects all versions up to 20250513. The vulnerability can be exploited remotely without authentication.
💻 Affected Systems
- H3C SecCenter SMP-E1114P02
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive system files, configuration files, or credential files, potentially leading to full system compromise.
Likely Case
Unauthorized access to sensitive files containing configuration data, logs, or credentials.
If Mitigated
Limited access to non-critical files if proper file permissions and network segmentation are in place.
🎯 Exploit Status
Exploit details have been publicly disclosed and the vulnerability requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider workarounds or upgrading to a version after 20250513 if available.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to the affected endpoint using firewall rules or network segmentation.
iptables -A INPUT -p tcp --dport [PORT] -s [TRUSTED_IPS] -j ACCEPT
iptables -A INPUT -p tcp --dport [PORT] -j DROP
Web Application Firewall
allDeploy a WAF with path traversal protection rules to block malicious requests.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the affected system from untrusted networks
- Monitor for suspicious file access patterns and implement file integrity monitoring
🔍 How to Verify
Check if Vulnerable:
Test if the /packetCaptureStrategy/download endpoint accepts path traversal sequences in the Name parameterCheck Version:
Check system version through web interface or CLI (specific command varies by deployment)Verify Fix Applied:
Verify that path traversal attempts are properly rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns
- Requests to /packetCaptureStrategy/download with suspicious Name parameters
- Failed file access attempts outside expected directories
Network Indicators:
- HTTP requests containing '../' or similar path traversal sequences
- Unusual file download patterns from the affected endpoint
SIEM Query:
source="web_logs" AND uri="/packetCaptureStrategy/download" AND (param="*../*" OR param="*..\\*" OR param="*%2e%2e%2f*")