{"metadata": {"vulnerability": "CVE-2025-34047", "count": 50, "kinds": {"milestone": 4, "sighting": 27, "kev": 11, "other": 8}, "linked_omitted": 0}, "data": [{"timestamp": "2025-04-15T19:15:22.547Z", "date_only": false, "value": "2025-04-15T19:15:22.547Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-34047", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-06-26T16:10:37.548Z", "date_only": false, "value": "2025-06-26T16:10:37.548Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-34047", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-06-26T16:15:28Z", "date_only": false, "value": "2025-06-26T16:15:28Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-F369-PP94-CGWP", "record": "GHSA-F369-PP94-CGWP", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2025-06-26T16:15:28.140Z", "date_only": false, "value": "2025-06-26T16:15:28.140", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-34047", "record": "FKIE_CVE-2025-34047", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-06-26T16:51:43Z", "date_only": false, "value": "2025-06-26T16:51:43.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/19625", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "8b7a7a32-5f52-4642-b025-888d7b92f6a5", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-34047\n\ud83d\udd25 CVSS Score: 8.7 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)\n\ud83d\udd39 Description: A path traversal vulnerability exists in the Leadsec SSL VPN (formerly Lenovo NetGuard), allowing unauthenticated attackers to read arbitrary files on the underlying system via the ostype parameter in the /vpn/user/download/client endpoint. This flaw arises from insufficient input sanitation, enabling traversal sequences\u00a0to escape the intended directory and access sensitive files.\n\ud83d\udccf Published: 2025-06-26T16:10:37.548Z\n\ud83d\udccf Modified: 2025-06-26T16:10:37.548Z\n\ud83d\udd17 References:\n1. https://www.cnvd.org.cn/flaw/show/CNVD-2021-64035\n2. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cnvd/2021/CNVD-2021-64035.yaml\n3. https://www.leadsec.com.cn/\n4. https://vulncheck.com/advisories/leadsec-vpn-path-traversal-file-read", "url": "https://t.me/DarkWebInformer_CVEAlerts/19625", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-06-26T18:31:28Z", "date_only": false, "value": "2025-06-26T18:31:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F369-PP94-CGWP", "record": "GHSA-F369-PP94-CGWP", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-06-26T20:49:46.627Z", "date_only": false, "value": "2025-06-26T20:49:46.627680Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lsjytu4jk62p", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "653844ec-8c7d-4f54-ad32-f582e21cfa0a", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3lsjytu4jk62p"}, {"timestamp": "2025-06-27T21:02:23.193Z", "date_only": false, "value": "2025-06-27T21:02:23.193452Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lsmjza5epk2u", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "0c2499e0-0b91-42ba-86c2-a1ffeb292606", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lsmjza5epk2u"}, {"timestamp": "2025-11-20T20:54:01.500Z", "date_only": false, "value": "2025-11-20T20:54:01.500Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2025-34047", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-11-20T21:30:29Z", "date_only": false, "value": "2025-11-20T21:30:29Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F369-PP94-CGWP", "record": "GHSA-F369-PP94-CGWP", "field": "modified", "linked_record": true}, {"timestamp": "2025-12-23T16:48:39.113Z", "date_only": false, "value": "2025-12-23T16:48:39.113728Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-34047", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-12-23T16:48:39.113Z", "date_only": false, "value": "2025-12-23T16:48:39.113728Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-34047", "record": "FKIE_CVE-2025-34047", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2025-12-23T16:49:13.278Z", "date_only": false, "value": "2025-12-23T16:49:13.278Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-34047", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-12-23T16:49:13.278Z", "date_only": false, "value": "2025-12-23T16:49:13.278Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-34047", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-01-08T10:50:51Z", "date_only": false, "value": "2026-01-08T10:50:51+00:00", "kind": "kev", "label": "Asserted", "source": "shadowserver", "record": "CVE-2025-34047", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "7a29ec24-0c08-49c3-b85c-d778e0dbc6c7", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-01-08T10:50:51Z", "date_only": false, "value": "2026-01-08T10:50:51+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2025-34047", "field": "timestamps.first_seen_at", "metric_role": "exploitation", "metric_basis": "kev_first_seen", "uuid": "7a29ec24-0c08-49c3-b85c-d778e0dbc6c7", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-02-04T00:00:00Z", "date_only": false, "value": "2026-02-04T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2025-34047", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "ff4e5e6e-f391-4a55-9c01-f71e72c94be7", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-02-04T00:00:00Z", "date_only": false, "value": "2026-02-04T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2025-34047", "field": "evidence.0.details.added_date", "uuid": "ff4e5e6e-f391-4a55-9c01-f71e72c94be7", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-02-04T00:00:00Z", "date_only": false, "value": "2026-02-04T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-04)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "0612735e-5160-4114-8508-ce3626fa0a7c", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-02-04T00:00:00Z", "date_only": false, "value": "2026-02-04T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2025-34047", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "ff4e5e6e-f391-4a55-9c01-f71e72c94be7", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-02-04T00:00:00Z", "date_only": false, "value": "2026-02-04T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2025-34047", "field": "status.status_updated_at", "uuid": "ff4e5e6e-f391-4a55-9c01-f71e72c94be7", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-02-12T00:00:00Z", "date_only": false, "value": "2026-02-12T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-12)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "ab769e6d-af9c-473f-b453-d25121149ab6", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-03-18T00:00:00Z", "date_only": false, "value": "2026-03-18T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-18)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "31c14801-f675-4745-823e-6ef6b77978c0", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-03-28T00:00:00Z", "date_only": false, "value": "2026-03-28T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-28)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "306926dd-b4da-47d3-8562-4179c4efffc4", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-03-29T00:00:00Z", "date_only": false, "value": "2026-03-29T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-29)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "2c0d12bf-102b-425e-a0ff-41cabfe00806", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-04-05T00:00:00Z", "date_only": false, "value": "2026-04-05T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-04-05)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "d2f8b592-0433-439f-82fe-964a1558d76e", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-04-07T00:00:00Z", "date_only": false, "value": "2026-04-07T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-04-07)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "7d616436-2785-4126-affb-14f43114592b", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-04-14T00:00:00Z", "date_only": false, "value": "2026-04-14T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-04-14)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "49ed822c-ebce-4557-b461-995dd63c9a8c", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-04-15T00:00:00Z", "date_only": false, "value": "2026-04-15T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-04-15)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "5d04a79e-3668-4d19-a4b4-34127aaac7be", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-11T00:00:00Z", "date_only": false, "value": "2026-06-11T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-11)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "8d72b151-7c0a-4d68-90b2-a86ced9fe42c", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-16T00:00:00Z", "date_only": false, "value": "2026-06-16T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-16)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "8f49b595-c7a7-4050-8e28-0b49a96decf8", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-17T09:13:22.493Z", "date_only": false, "value": "2026-06-17T09:13:22.493", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-34047", "record": "FKIE_CVE-2025-34047", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-06-19T12:45:41.515Z", "date_only": false, "value": "2026-06-19T12:45:41.515776Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3778b439-61a7-4636-9d22-1cacf2fb05b1", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "46849805-7eff-49bd-8638-900671ee44f2", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3778b439-61a7-4636-9d22-1cacf2fb05b1", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-20T00:00:00Z", "date_only": false, "value": "2026-06-20T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-20)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "67b819d3-b844-4690-bf2b-76c5dd55fe37", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T14:02:37Z", "date_only": false, "value": "2026-06-23T14:02:37+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2025-34047", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "ff4e5e6e-f391-4a55-9c01-f71e72c94be7", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T14:03:09.636Z", "date_only": false, "value": "2026-06-23T14:03:09.636594Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ff4e5e6e-f391-4a55-9c01-f71e72c94be7", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "085adffe-a9fe-46aa-8eda-675f6881844b", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ff4e5e6e-f391-4a55-9c01-f71e72c94be7", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-30T09:22:39.381Z", "date_only": false, "value": "2026-06-30T09:22:39.381296Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7a29ec24-0c08-49c3-b85c-d778e0dbc6c7", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "2326aaa0-49ae-4743-bea0-ac5b6f694868", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7a29ec24-0c08-49c3-b85c-d778e0dbc6c7", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-17T10:15:09.017Z", "date_only": false, "value": "2026-07-17T10:15:09.017442Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-16)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "20e548e2-fa88-49cd-8dcb-c6ad7022a677", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-20T10:15:07.399Z", "date_only": false, "value": "2026-07-20T10:15:07.399028Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-19)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "f19371b8-251e-4c4e-b4a3-57b9edc7cb45", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-20T10:15:18.137Z", "date_only": false, "value": "2026-08-20T10:15:18.137257Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-19)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "c804612d-c5d4-4b48-ae99-fdef9541e297", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-29T10:15:19.902Z", "date_only": false, "value": "2026-08-29T10:15:19.902087Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-28)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "3becd189-afbd-43f4-99b5-f3058d5c84ef", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-02T10:15:08.854Z", "date_only": false, "value": "2026-09-02T10:15:08.854568Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-01)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "42366479-0a1d-4338-959f-3ab138d8f364", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-03T10:15:16.714Z", "date_only": false, "value": "2026-09-03T10:15:16.714926Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-02)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "aee15666-8b3c-4b92-afa7-fa85143e62b0", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-06T10:15:10.053Z", "date_only": false, "value": "2026-09-06T10:15:10.053421Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "e5f155c9-3f75-4864-9f8b-a23f029f96fb", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-21T10:15:11.798Z", "date_only": false, "value": "2026-09-21T10:15:11.798541Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-20)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "4be77f55-7570-4b72-b880-ab7192092c2b", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-26)", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "ff302cb1-ef97-48d9-a4a2-7c154dbba4dc", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-12T00:00:00Z", "date_only": false, "value": "2026-11-12T00:00:00+00:00", "kind": "kev", "label": "Last seen", "source": "shadowserver", "record": "CVE-2025-34047", "field": "timestamps.last_seen_at", "uuid": "7a29ec24-0c08-49c3-b85c-d778e0dbc6c7", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-12T00:00:00Z", "date_only": true, "value": "2026-11-12", "kind": "kev", "label": "Observation date", "source": "shadowserver", "record": "CVE-2025-34047", "field": "evidence.0.details.observation_date", "uuid": "7a29ec24-0c08-49c3-b85c-d778e0dbc6c7", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-12T00:00:00Z", "date_only": false, "value": "2026-11-12T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "shadowserver", "record": "CVE-2025-34047", "field": "status.status_updated_at", "uuid": "7a29ec24-0c08-49c3-b85c-d778e0dbc6c7", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-14T01:00:01Z", "date_only": false, "value": "2026-11-14T01:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "shadowserver", "record": "CVE-2025-34047", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "7a29ec24-0c08-49c3-b85c-d778e0dbc6c7", "status": {"status_reason": "confirmed", "exploited": true}}], "metrics": {"as_of": "2026-11-14T22:57:47.297Z", "anchors": {"origin": {"timestamp": "2025-06-26T16:10:37.548Z", "date_only": false, "value": "2025-06-26T16:10:37.548Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-34047", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2025-06-26T16:10:37.548Z", "date_only": false, "value": "2025-06-26T16:10:37.548Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-34047", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2025-06-26T16:51:43Z", "date_only": false, "value": "2025-06-26T16:51:43.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/19625", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "8b7a7a32-5f52-4642-b025-888d7b92f6a5", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-34047\n\ud83d\udd25 CVSS Score: 8.7 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)\n\ud83d\udd39 Description: A path traversal vulnerability exists in the Leadsec SSL VPN (formerly Lenovo NetGuard), allowing unauthenticated attackers to read arbitrary files on the underlying system via the ostype parameter in the /vpn/user/download/client endpoint. This flaw arises from insufficient input sanitation, enabling traversal sequences\u00a0to escape the intended directory and access sensitive files.\n\ud83d\udccf Published: 2025-06-26T16:10:37.548Z\n\ud83d\udccf Modified: 2025-06-26T16:10:37.548Z\n\ud83d\udd17 References:\n1. https://www.cnvd.org.cn/flaw/show/CNVD-2021-64035\n2. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cnvd/2021/CNVD-2021-64035.yaml\n3. https://www.leadsec.com.cn/\n4. https://vulncheck.com/advisories/leadsec-vpn-path-traversal-file-read", "url": "https://t.me/DarkWebInformer_CVEAlerts/19625", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2026-01-08T10:50:51Z", "date_only": false, "value": "2026-01-08T10:50:51+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2025-34047", "field": "timestamps.first_seen_at", "metric_role": "exploitation", "metric_basis": "kev_first_seen", "uuid": "7a29ec24-0c08-49c3-b85c-d778e0dbc6c7", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 16915213.452, "hours": 4698.6704033333335, "days": 195.77793347222223, "min_seconds": 16915213.452, "max_seconds": 16915213.452, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-06-26T16:10:37.548Z", "date_only": false, "value": "2025-06-26T16:10:37.548Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-34047", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-01-08T10:50:51Z", "date_only": false, "value": "2026-01-08T10:50:51+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2025-34047", "field": "timestamps.first_seen_at", "metric_role": "exploitation", "metric_basis": "kev_first_seen", "uuid": "7a29ec24-0c08-49c3-b85c-d778e0dbc6c7", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 16915213.452, "hours": 4698.6704033333335, "days": 195.77793347222223, "min_seconds": 16915213.452, "max_seconds": 16915213.452, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-06-26T16:10:37.548Z", "date_only": false, "value": "2025-06-26T16:10:37.548Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-34047", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-01-08T10:50:51Z", "date_only": false, "value": "2026-01-08T10:50:51+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2025-34047", "field": "timestamps.first_seen_at", "metric_role": "exploitation", "metric_basis": "kev_first_seen", "uuid": "7a29ec24-0c08-49c3-b85c-d778e0dbc6c7", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 2465.452, "hours": 0.6848477777777778, "days": 0.028535324074074078, "min_seconds": 2465.452, "max_seconds": 2465.452, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-06-26T16:10:37.548Z", "date_only": false, "value": "2025-06-26T16:10:37.548Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-34047", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2025-06-26T16:51:43Z", "date_only": false, "value": "2025-06-26T16:51:43.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/19625", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "8b7a7a32-5f52-4642-b025-888d7b92f6a5", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-34047\n\ud83d\udd25 CVSS Score: 8.7 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)\n\ud83d\udd39 Description: A path traversal vulnerability exists in the Leadsec SSL VPN (formerly Lenovo NetGuard), allowing unauthenticated attackers to read arbitrary files on the underlying system via the ostype parameter in the /vpn/user/download/client endpoint. This flaw arises from insufficient input sanitation, enabling traversal sequences\u00a0to escape the intended directory and access sensitive files.\n\ud83d\udccf Published: 2025-06-26T16:10:37.548Z\n\ud83d\udccf Modified: 2025-06-26T16:10:37.548Z\n\ud83d\udd17 References:\n1. https://www.cnvd.org.cn/flaw/show/CNVD-2021-64035\n2. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cnvd/2021/CNVD-2021-64035.yaml\n3. https://www.leadsec.com.cn/\n4. https://vulncheck.com/advisories/leadsec-vpn-path-traversal-file-read", "url": "https://t.me/DarkWebInformer_CVEAlerts/19625", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 43742829.749421, "hours": 12150.786041505833, "days": 506.2827517294097, "min_seconds": 43742829.749421, "max_seconds": 43742829.749421, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-06-26T16:10:37.548Z", "date_only": false, "value": "2025-06-26T16:10:37.548Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-34047", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T22:57:47.297Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 26827616.297421, "hours": 7452.1156381725, "days": 310.50481825718754, "min_seconds": 26827616.297421, "max_seconds": 26827616.297421, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-01-08T10:50:51Z", "date_only": false, "value": "2026-01-08T10:50:51+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2025-34047", "field": "timestamps.first_seen_at", "metric_role": "exploitation", "metric_basis": "kev_first_seen", "uuid": "7a29ec24-0c08-49c3-b85c-d778e0dbc6c7", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-11-14T22:57:47.297Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 43740364.297421, "hours": 12150.101193728056, "days": 506.2542164053357, "min_seconds": 43740364.297421, "max_seconds": 43740364.297421, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-06-26T16:51:43Z", "date_only": false, "value": "2025-06-26T16:51:43.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/19625", "record": "CVE-2025-34047", "field": "creation_timestamp", "uuid": "8b7a7a32-5f52-4642-b025-888d7b92f6a5", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-34047\n\ud83d\udd25 CVSS Score: 8.7 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)\n\ud83d\udd39 Description: A path traversal vulnerability exists in the Leadsec SSL VPN (formerly Lenovo NetGuard), allowing unauthenticated attackers to read arbitrary files on the underlying system via the ostype parameter in the /vpn/user/download/client endpoint. This flaw arises from insufficient input sanitation, enabling traversal sequences\u00a0to escape the intended directory and access sensitive files.\n\ud83d\udccf Published: 2025-06-26T16:10:37.548Z\n\ud83d\udccf Modified: 2025-06-26T16:10:37.548Z\n\ud83d\udd17 References:\n1. https://www.cnvd.org.cn/flaw/show/CNVD-2021-64035\n2. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cnvd/2021/CNVD-2021-64035.yaml\n3. https://www.leadsec.com.cn/\n4. https://vulncheck.com/advisories/leadsec-vpn-path-traversal-file-read", "url": "https://t.me/DarkWebInformer_CVEAlerts/19625", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-14T22:57:47.297Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}