CVE-2014-125125 A10 Networks AX Loadbalancer Path Traversal
Unauthenticated attackers can read arbitrary files and cause unintended file deletion via path traversal in the AX Loadbalancer downloads endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-125125?
CVE-2014-125125 is a high-severity path traversal vulnerability in A10 Networks AX Series Loadbalancer, published on 31 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A path traversal vulnerability exists in A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier. The vulnerability resides in the handling of the filename parameter in the /xml/downloads endpoint, which fails to properly sanitize user input. An unauthenticated attacker can exploit this flaw by sending crafted HTTP requests containing directory traversal sequences to read arbitrary files outside the intended directory. The files returned by the vulnerable endpoint are deleted from the system after retrieval. This can lead to unauthorized disclosure of sensitive information such as SSL certificates and private keys, as well as unintended file deletion.
Which versions are affected by CVE-2014-125125?
How do I fix CVE-2014-125125?
No fix has been published for CVE-2014-125125 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2014-125125 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-125125 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-c8cm-6cj9-946w.