cnvd - cnvd-2025-28726

CNVD-2025-28726

Vulnerability from cnvd - Published: 2025-11-21

Title

Netgear SPH200D目录遍历漏洞

Description

Netgear SPH200D是美国网件（Netgear）公司的一款无线网络电话。 Netgear SPH200D存在目录遍历漏洞，攻击者可利用该漏洞通过发送精心编制的URL请求来查看系统上的任意文件。

Severity

中

Formal description

厂商尚未提供漏洞修复方案，请关注厂商主页更新： http://support.netgear.com/product/SPH200D

Reference

https://nvd.nist.gov/vuln/detail/CVE-2013-10063

Impacted products

Name
NETGEAR SPH200D <=1.0.4.80

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2013-10063",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2013-10063"
    }
  },
  "description": "Netgear SPH200D\u662f\u7f8e\u56fd\u7f51\u4ef6\uff08Netgear\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u65e0\u7ebf\u7f51\u7edc\u7535\u8bdd\u3002\n\nNetgear SPH200D\u5b58\u5728\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u53d1\u9001\u7cbe\u5fc3\u7f16\u5236\u7684URL\u8bf7\u6c42\u6765\u67e5\u770b\u7cfb\u7edf\u4e0a\u7684\u4efb\u610f\u6587\u4ef6\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttp://support.netgear.com/product/SPH200D",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-28726",
  "openTime": "2025-11-21",
  "products": {
    "product": "NETGEAR SPH200D \u003c=1.0.4.80"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2013-10063",
  "serverity": "\u4e2d",
  "submitTime": "2025-08-11",
  "title": "Netgear SPH200D\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e"
}

CVE-2013-10063 (GCVE-0-2013-10063)

Vulnerability from cvelistv5 – Published: 2025-08-01 20:46 – Updated: 2025-11-21 00:19

Summary

A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions <= 1.0.4.80 in its embedded web server. Authenticated attackers can exploit crafted GET requests to access arbitrary files outside the web root by injecting traversal sequences. This can expose sensitive system files and configuration data.

Severity ?

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck

References

URL

Tags

	https://raw.githubusercontent.com/rapid7/metasplo…	exploit
	https://www.exploit-db.com/exploits/24441	exploit
	https://web.archive.org/web/20130207034706/http:/…	technical-descriptionexploit
	https://www.vulncheck.com/advisories/netgear-sph2…	third-party-advisory

Impacted products

	Vendor	Product	Version
	Netgear	SPH200D	Affected: * , ≤ 1.0.4.80 (semver)

Credits

Michael Messner

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2013-10063",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-06T14:38:41.804173Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-06T14:38:45.793Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://web.archive.org/web/20130207034706/http://www.s3cur1ty.de/m1adv2013-002"
          },
          {
            "tags": [
              "exploit"
            ],
            "url": "https://www.exploit-db.com/exploits/24441"
          },
          {
            "tags": [
              "exploit"
            ],
            "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/netgear_sph200d_traversal.rb"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Any GET-accessible path"
          ],
          "product": "SPH200D",
          "vendor": "Netgear",
          "versions": [
            {
              "lessThanOrEqual": "1.0.4.80",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:netgear:sph200d:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.0.4.80",
                  "versionStartIncluding": "*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Michael Messner"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions \u0026lt;= 1.0.4.80 in its embedded web server. Authenticated attackers can exploit crafted GET requests to access arbitrary files outside the web root by injecting traversal sequences.\u0026nbsp;This can expose sensitive system files and configuration data.\u003c/p\u003e"
            }
          ],
          "value": "A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions \u003c= 1.0.4.80 in its embedded web server. Authenticated attackers can exploit crafted GET requests to access arbitrary files outside the web root by injecting traversal sequences.\u00a0This can expose sensitive system files and configuration data."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-21T00:19:04.889Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/netgear_sph200d_traversal.rb"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/24441"
        },
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://web.archive.org/web/20130207034706/http://www.s3cur1ty.de/m1adv2013-002"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/netgear-sph200d-path-traversal-via-http-get"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "Netgear SPH200D \u003c= 1.0.4.80 Path Traversal via HTTP GET",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2013-10063",
    "datePublished": "2025-08-01T20:46:21.225Z",
    "dateReserved": "2025-08-01T18:54:27.633Z",
    "dateUpdated": "2025-11-21T00:19:04.889Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2025-28726

CVE-2013-10063 (GCVE-0-2013-10063)

Tags

Sightings

Nomenclature