CVE-2024-8497 Franklin Fueling Systems TS-550 EVO Absolute Path Traversal
An attacker can exploit an absolute path traversal vulnerability to read arbitrary files and obtain administrator credentials on Franklin Fueling Systems TS-550 EVO devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-8497?
CVE-2024-8497 is a high-severity path traversal vulnerability in Franklin Fueling Systems TS-550 EVO, published on 24 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Franklin Fueling Systems TS-550 EVO versions prior to 2.26.4.8967 possess a file that can be read arbitrarily that could allow an attacker obtain administrator credentials.
Weakness: CWE-36
Which versions are affected by CVE-2024-8497?
How do I fix CVE-2024-8497?
No fix has been published for CVE-2024-8497 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-8497 being exploited?
There is no known exploitation of CVE-2024-8497 in the wild and no public exploit code.
Sources
Also known as GHSA-h55v-8rq9-7qx3.