CVE-2024-27776

The vulnerability is based on improper limitation of a pathname to a restricted directory. An attacker can craft a network request containing path traversal sequences (e.g., '../') to escape the allowed filesystem area and gain access to sensitive resources or execute arbitrary code. The attack requires no authentication or user interaction and is possible remotely over the network.

An attacker can gain complete control over the vulnerable system by executing arbitrary code remotely (RCE), and can also gain unauthorized access to sensitive data, modify it, or cause service unavailability.

Patches available from the manufacturer should be applied according to the references. Due to the lack of authentication requirement, it is also recommended to restrict network access to the DeviceHub interface only to trusted IP addresses until the update is deployed.

MileSight DeviceHub — versions indicated in the manufacturer's references