Vulnerability-Lookup

CNVD-2025-28726

Vulnerability from cnvd - Published: 2025-11-21

Title

Netgear SPH200D目录遍历漏洞

Description

Netgear SPH200D是美国网件（Netgear）公司的一款无线网络电话。 Netgear SPH200D存在目录遍历漏洞，攻击者可利用该漏洞通过发送精心编制的URL请求来查看系统上的任意文件。

Severity

中

Formal description

厂商尚未提供漏洞修复方案，请关注厂商主页更新： http://support.netgear.com/product/SPH200D

Reference

https://nvd.nist.gov/vuln/detail/CVE-2013-10063

Impacted products

Name
NETGEAR SPH200D <=1.0.4.80

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2013-10063",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2013-10063"
    }
  },
  "description": "Netgear SPH200D\u662f\u7f8e\u56fd\u7f51\u4ef6\uff08Netgear\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u65e0\u7ebf\u7f51\u7edc\u7535\u8bdd\u3002\n\nNetgear SPH200D\u5b58\u5728\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u53d1\u9001\u7cbe\u5fc3\u7f16\u5236\u7684URL\u8bf7\u6c42\u6765\u67e5\u770b\u7cfb\u7edf\u4e0a\u7684\u4efb\u610f\u6587\u4ef6\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttp://support.netgear.com/product/SPH200D",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-28726",
  "openTime": "2025-11-21",
  "products": {
    "product": "NETGEAR SPH200D \u003c=1.0.4.80"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2013-10063",
  "serverity": "\u4e2d",
  "submitTime": "2025-08-11",
  "title": "Netgear SPH200D\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e"
}

CVE-2013-10063 (GCVE-0-2013-10063)

Vulnerability from cvelistv5 – Published: 2025-08-01 20:46 – Updated: 2026-05-15 11:14 Unsupported When Assigned

Title

Netgear SPH200D <= 1.0.4.80 Path Traversal via HTTP GET

Summary

A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions <= 1.0.4.80 in its embedded web server. Authenticated attackers can exploit crafted GET requests to access arbitrary files outside the web root by injecting traversal sequences. This can expose sensitive system files and configuration data.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-08-06 14:38 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck mitre root

References

4 references

URL	Tags
https://raw.githubusercontent.com/rapid7/metasplo…	exploit
https://www.exploit-db.com/exploits/24441	exploit
https://web.archive.org/web/20130207034706/http:/…	technical-descriptionexploit
https://www.vulncheck.com/advisories/netgear-sph2…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Netgear	SPH200D	Affected: 0 , ≤ 1.0.4.80 (custom) cpe:2.3:a:netgear:sph200d::::::::

Date Public

2013-01-31 00:00

Credits

Michael Messner

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2013-10063",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-06T14:38:41.804173Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-06T14:38:45.793Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://web.archive.org/web/20130207034706/http://www.s3cur1ty.de/m1adv2013-002"
          },
          {
            "tags": [
              "exploit"
            ],
            "url": "https://www.exploit-db.com/exploits/24441"
          },
          {
            "tags": [
              "exploit"
            ],
            "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/netgear_sph200d_traversal.rb"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Any GET-accessible path"
          ],
          "product": "SPH200D",
          "vendor": "Netgear",
          "versions": [
            {
              "lessThanOrEqual": "1.0.4.80",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:netgear:sph200d:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.0.4.80",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Michael Messner"
        }
      ],
      "datePublic": "2013-01-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions \u0026lt;= 1.0.4.80 in its embedded web server. Authenticated attackers can exploit crafted GET requests to access arbitrary files outside the web root by injecting traversal sequences.\u0026nbsp;This can expose sensitive system files and configuration data.\u003c/p\u003e"
            }
          ],
          "value": "A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions \u003c= 1.0.4.80 in its embedded web server. Authenticated attackers can exploit crafted GET requests to access arbitrary files outside the web root by injecting traversal sequences.\u00a0This can expose sensitive system files and configuration data."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-15T11:14:18.461Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/netgear_sph200d_traversal.rb"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/24441"
        },
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://web.archive.org/web/20130207034706/http://www.s3cur1ty.de/m1adv2013-002"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/netgear-sph200d-path-traversal-via-http-get"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "Netgear SPH200D \u003c= 1.0.4.80 Path Traversal via HTTP GET",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2013-10063",
    "datePublished": "2025-08-01T20:46:21.225Z",
    "dateReserved": "2025-08-01T18:54:27.633Z",
    "dateUpdated": "2026-05-15T11:14:18.461Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.