Which versions of Pironman Dashboard are affected by CVE-2026-25069?

SunFounder Pironman Dashboard versions 1.3.13 and earlier contain a critical unauthenticated remote file-access vulnerability affecting Raspberry Pi-based infrastructure, enabling attackers to…

Is there a public PoC exploit available for CVE-2026-25069?

Yes, a public proof-of-concept exploit is available for CVE-2026-25069. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-25069?

Within 24 hours, inventory all SunFounder Pironman Dashboard deployments running version 1.3.13 or earlier and assess network accessibility from untrusted sources. Within 7 days, implement network segmentation to restrict dashboard access-confine affected systems to internal networks only, disable remote connectivity, and/or deploy a reverse proxy or API gateway requiring authentication before any connection reaches the dashboard. Within 30 days, monitor SunFounder's security advisories and GitHub repository for available patches; if no vendor fix is released within 60 days, begin evaluation of alternative Raspberry Pi dashboard solutions to reduce long-term risk exposure.

Pironman Dashboard CVE-2026-25069

Q: What is the CVSS score of CVE-2026-25069?

CVE-2026-25069 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

CRITICAL

Path Traversal (CWE-22)

2026-02-01 disclosure@vulncheck.com

Denial Of Service Path Traversal

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network path traversal (AV:N/AC:L/PR:N/UI:N); arbitrary file read gives C:H, arbitrary delete of critical files gives I:H and A:H; no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 16:45 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 14, 2026 - 16:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jul 14, 2026 - 16:22 NVD

9.3 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

PoC Detected

Feb 03, 2026 - 16:44 vuln.today

Public exploit code

CVE Published

Feb 01, 2026 - 00:16 nvd

N/A

DescriptionCVE.org

SunFounder Pironman Dashboard (pm_dashboard) version 1.3.13 and prior contain a path traversal vulnerability in the log file API endpoints. An unauthenticated remote attacker can supply traversal sequences via the filename parameter to read and delete arbitrary files. Successful exploitation can disclose sensitive information and delete critical system files, resulting in data loss and potential system compromise or denial of service.

AnalysisAI

Unauthenticated arbitrary file read and delete in SunFounder's Pironman Dashboard (pm_dashboard) 1.3.13 and earlier lets remote attackers abuse a path-traversal flaw in the log-file API to exfiltrate sensitive files and destroy critical system files. The dashboard runs on Raspberry Pi power/cooling hardware, so a successful attack can disclose configuration/secrets and cause data loss or denial of service. Publicly available exploit code exists; no active exploitation is confirmed, and EPSS remains low (0.20%).

Technical ContextAI

pm_dashboard is a Python-based web management dashboard bundled with SunFounder Pironman Raspberry Pi enclosure/UPS/cooling kits, exposing REST API endpoints for device telemetry and log management. The vulnerability is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the log-file API endpoints accept a user-controlled 'filename' parameter that is joined to a base log directory without canonicalization or boundary checks, so sequences such as '../' escape the intended directory. The NVD references point at pm_dashboard.py (lines ~62 and ~440), indicating the file-handling routines for reading and deleting logs are the sink. Because the handler performs both reads and unlinks on the attacker-supplied path, the same weakness yields both information disclosure and destructive file deletion.

Affected ProductsAI

SunFounder Pironman Dashboard (pm_dashboard) version 1.3.13 and all prior versions are affected, per the CVE description and the VulnCheck advisory (https://www.vulncheck.com/advisories/sunfounder-pironman-dashboard-path-traversal-arbitrary-file-read-deletion). No CPE string was supplied in the input, so exact platform enumeration is not independently confirmed. The affected code resides in the upstream project at https://github.com/sunfounder/pm_dashboard (see pm_dashboard/pm_dashboard.py lines 62 and 440). The dashboard is distributed with SunFounder Pironman Raspberry Pi case/UPS/cooling accessories.

RemediationAI

No vendor-released patch or fixed version number is identified in the available data, so a specific upgrade target cannot be cited; monitor the upstream repository (https://github.com/sunfounder/pm_dashboard) and the VulnCheck advisory for a fixed release. As compensating controls, restrict network access to the dashboard by binding it to localhost or placing it behind a firewall/VPN so the log API is not reachable from untrusted networks (trade-off: remote monitoring convenience is lost); put an authenticating reverse proxy in front of the endpoints since the app itself enforces no authentication on the vulnerable path (trade-off: added setup and a proxy to maintain); and run the dashboard as a low-privilege, sandboxed user with a read-only or tightly scoped filesystem so traversal and deletion cannot reach sensitive system files (trade-off: may break legitimate log rotation/cleanup). If the log-file read/delete feature is not required, disable or block those API routes entirely.