Satel SenNet Datalogger EUVD-2026-94221

Exploitation requires valid authentication to the device's built-in web portal (PR:L) - the attacker must already possess low-privileged web-portal credentials. Given that, the attacker simply inserts a path-traversal payload (e.g., ../) into a URL parameter against the web portal; no user interaction and no non-default configuration are needed since the vulnerable web portal is a standard device feature. The limiting factors are: (1) network reachability of the device's web interface, which on properly segmented OT/ICS networks should not be internet-exposed, and (2) the authentication requirement, which blocks fully anonymous attackers but offers little protection where credentials are default, shared, or weak. Disclosure is bounded to files and directories readable by the web server's system user.

This is a moderate-severity confidentiality issue rather than a top-priority emergency. The vendor-aligned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation but requires existing low-level authentication (PR:L), which meaningfully limits the attacker population to those already holding valid web-portal credentials. Impact is confined to confidentiality (VC:H, VI:N, VA:N): arbitrary file read and directory listing within the scope of the web server's system user, with no integrity or availability impact and no scope change. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable near-term exploitation - the 7.1 score is driven by the file-disclosure impact, not by exploitation likelihood. The one notable tension is PR:L versus real-world deployment: if portal credentials are shared, weak, or default on these ICS/monitoring devices, the authentication barrier is weaker in practice than the vector implies. Treat as a prioritized-but-not-urgent patch for exposed or multi-user deployments; de-prioritize for isolated, single-operator installations.

An attacker with valid but low-privileged web-portal credentials on a SenNet Datalogger Serie 200 modifies a URL to insert a path-traversal sequence (e.g., ../../), causing the web server to read files or list directories outside the intended web root. This lets them harvest configuration files, credentials, or other confidential system data accessible to the web server's user. No public exploit code was identified at time of analysis, though the technique is trivial to reproduce manually.