VULNERABILITY INTELLIGENCE

CVE-2017-16786

CVSS score6.5 MEDIUM

EPSS probability2.01%

CISA KEVNot currently listed

Published2017-12-19

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users with certain privileges to read arbitrary files via (1) the ntpclientcounterlogfile parameter to cgi-bin/mainv2 or (2) vectors involving curl support of the "file" schema in the firmware update functionality.

Weakness classification

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references

cve@mitre.org — Issue Tracking, Third Party Advisory, VDB Entry
cve@mitre.org — Issue Tracking, Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Mailing List, Third Party Advisory