What is the CVSS score of EUVD-2025-17512?

EUVD-2025-17512 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by EUVD-2025-17512?

A path traversal vulnerability in Frenify Arlo versions up to 6.0.3 allows attackers to read arbitrary files from affected systems through PHP Local File Inclusion, potentially exposing sensitive…

How to fix or mitigate EUVD-2025-17512?

Within 24 hours: Inventory all systems running Arlo and isolate affected instances from production networks if operationally feasible; restrict access to Arlo to trusted internal networks only. Within 7 days: Deploy Web Application Firewall (WAF) rules to block path traversal patterns (../, ..\, encoded variants); disable any non-essential Arlo features and implement strict input validation. Within 30 days: Evaluate upgrade to a patched version once available; consider alternative solutions if vendor patch timeline is extended; conduct file access audit to detect potential exploitation.

PHP EUVD-2025-17512

| CVE-2025-39475 HIGH

Path Traversal: '.../...//' (CWE-35)

2025-06-09 audit@patchstack.com

PHP Path Traversal

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17512

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 8.1

DescriptionCVE.org

Path Traversal vulnerability in Frenify Arlo allows PHP Local File Inclusion. This issue affects Arlo: from n/a through 6.0.3.

AnalysisAI

Path Traversal vulnerability enabling PHP Local File Inclusion (LFI) in Frenify Arlo through version 6.0.3. The vulnerability allows unauthenticated remote attackers to read arbitrary files from the server filesystem by manipulating path parameters, potentially exposing sensitive configuration files, source code, and credentials. With a CVSS score of 8.1 and network-accessible attack vector, this vulnerability poses significant risk to confidentiality and integrity; exploitation likelihood and active weaponization status cannot be confirmed from available data, but the straightforward nature of path traversal attacks suggests moderate-to-high real-world exploitation probability.

Technical ContextAI

The vulnerability stems from improper input validation in file inclusion mechanisms within Frenify Arlo (affected CPE likely: cpe:2.3:a:frenify:arlo:*:*:*:*:*:*:*:*). CWE-35 (Path Traversal) indicates the application fails to properly sanitize or validate user-supplied path parameters before using them in file operations. In PHP applications, this typically manifests through include(), require(), file_get_contents(), or similar functions that process user input without adequate canonicalization or directory restriction. The LFI nature suggests attackers can traverse directory hierarchies using sequences like '../' or null bytes to access files outside the intended web root or application directory, potentially including /etc/passwd, application configuration files, or database credentials stored in plaintext configuration scripts.

RemediationAI

priority: CRITICAL; action: Upgrade Frenify Arlo to version 6.0.4 or later; details: Vendor has released patches addressing path traversal input validation. Immediate upgrade is recommended for all instances running version 6.0.3 or earlier.
priority: HIGH; action: Implement Web Application Firewall (WAF) rules; details: Deploy WAF signatures to block common path traversal patterns (../, ..\, %2e%2e, null bytes, unicode encodings) in HTTP requests to Arlo endpoints prior to patching.
priority: HIGH; action: Restrict network access; details: Limit access to Arlo application to trusted networks or require VPN/IP whitelisting until patches can be applied; disable public internet exposure if operationally feasible.
priority: MEDIUM; action: File permission hardening; details: Restrict file system permissions on sensitive configuration files (/etc/passwd, application config files, .env, database credentials) to prevent disclosure via LFI even if path traversal succeeds.
priority: MEDIUM; action: Log and monitor for exploitation; details: Enable detailed logging of file inclusion requests and monitor for patterns consistent with directory traversal attempts (../ sequences, unusual file paths in request parameters).