Four-Faith Water Platform CVE-2025-11337

No authentication, user interaction, or special configuration is required: the flaw is exploitable against the /aloneReport/download.do endpoint of the Four-Faith Water Conservancy Informatization Platform (versions up to 2.2) by manipulating the fileName argument with directory-traversal sequences. The main limiting factor is reachability - the affected web interface must be network-accessible to the attacker (e.g. internet-exposed or reachable within the OT/IT network) - and impact is constrained to reading files the web service account can access, as this is file disclosure (CWE-22), not write or code execution. Because no vendor patch is confirmed, mitigation relies on network restriction/WAF filtering rather than an official fix.

This is a genuine but moderate-priority issue, not a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable, low-complexity path traversal requiring no authentication or user interaction, which favors ease of exploitation. However, impact is bounded: only confidentiality is affected and only at LOW (VC:L/VI:N/VA:N), consistent with CWE-22 arbitrary file read rather than code execution. The E:P (Proof-of-Concept) in the vector aligns with the description stating 'the exploit is now public,' so publicly available exploit code exists. EPSS is low at 0.69% (52nd percentile), and the CVE is NOT in CISA KEV, so there is no public exploit identified as actively exploited - exploitation is theoretically easy but not yet observed at scale. The signals are internally consistent: easy-to-reach but limited-impact flaw in a niche product, with a public PoC but no confirmed active exploitation. The vendor was contacted but did not respond, meaning no official patch is confirmed, which raises residual risk for any organization actually running this platform. Net: prioritize patching/mitigation if you run Four-Faith's water conservancy platform, but this is not a broad-fleet emergency.

A remote, unauthenticated attacker sends a crafted HTTP request to the /aloneReport/download.do endpoint with a manipulated fileName parameter containing traversal sequences (e.g. ../../) plus the path-confusion suffix shown in the advisory. Because a public proof-of-concept exists, the attacker can read arbitrary files outside the intended directory - such as configuration files or credentials - enabling information disclosure. The low complexity and lack of required authentication make opportunistic scanning and exploitation straightforward.