Meinberg LANTIME Web Configuration Utility version 6.16.008 suffers from an authentication bypass vulnerability.
c9529fb287c20dc6b7600d4cb6aeb966Title: Meinberg LANTIME Web Configuration Utility - Failure to Restrict URL
Access
Author: Jakub Palaczynski
CVE: CVE-2017-16787
Exploit tested on:
==================
Meinberg LANTIME Web Configuration Utility 6.16.008
Vulnerability affects:
======================
All LTOS6 firmware releases before 6.24.004
Vulnerability:
**************
Failure to Restrict URL Access:
===============================
Any user is able to read all files stored outside cgi-bin directory without
authentication. This way it is possible to download firmware, statistics or
diagnostics files that are stored in upload directory.
Contact:
========
Jakub[dot]Palaczynski[at]gmail[dot]com