EUVD-2025-21035CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Lifecycle Timeline
4Tags
Description
A path traversal vulnerability exists in Riverbed SteelHead VCX appliances (confirmed in VCX255U 9.6.0a) due to improper input validation in the log filtering functionality exposed via the management web interface. An authenticated attacker can exploit this flaw by submitting crafted filter expressions to the log_filter endpoint using the filterStr parameter. This input is processed by a backend parser that permits execution of file expansion syntax, allowing the attacker to retrieve arbitrary system files via the log viewing interface.
Analysis
A path traversal vulnerability in Riverbed SteelHead VCX appliances allows authenticated users to retrieve arbitrary system files through improper input validation in the log filtering functionality. The vulnerability affects VCX255U running version 9.6.0a and potentially other VCX models, enabling authenticated attackers to bypass access controls and read sensitive system files via crafted filter expressions. With a CVSS score of 7.1 and authentication requirement, this represents a significant confidentiality risk for organizations running affected appliances, though exploitation requires valid credentials.
Technical Context
The vulnerability resides in the log_filter endpoint of Riverbed SteelHead VCX's management web interface, which accepts a 'filterStr' parameter for log filtering operations. The backend parser improperly processes user-supplied input without adequate validation, allowing shell-style file expansion syntax (glob patterns, variable expansion, or similar metacharacters) to be interpreted. This is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating the root cause is insufficient input sanitization in a security-critical code path. The affected product line is Riverbed SteelHead VCX (CPE: vendor:riverbed, product:steelhead_vcx), specifically confirmed in model VCX255U version 9.6.0a. The vulnerability exploits the difference between what the application intends (log filtering) and what the parser executes (file system traversal via expansion syntax).
Affected Products
SteelHead VCX (['9.6.0a'])
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today