CVE-2024-2442 Path Traversal vulnerability in Franklin Fueling System EVO 550/5000
An attacker can exploit a path traversal flaw in Franklin Fueling System EVO controllers to access sensitive files on the device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-2442?
CVE-2024-2442 is a high-severity path traversal vulnerability in Franklin Fueling System EVO 5000, published on 19 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Franklin Fueling System EVO 550 and EVO 5000 are vulnerable to a Path Traversal vulnerability that could allow an attacker to access sensitive files on the system.
Weakness: CWE-25
Which versions are affected by CVE-2024-2442?
How do I fix CVE-2024-2442?
No fix has been published for CVE-2024-2442 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-2442 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-2442 exists.
Sources
Also known as GHSA-cxcr-v85c-3586.