4Mosan Management Center
Monthly
Unauthenticated remote file read in 4MOSAn Management Center (all versions prior to build 20260621) allows any network-reachable attacker to download arbitrary system files via a Relative Path Traversal flaw (CWE-23). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) confirms no authentication, no user interaction, and no special configuration is required to trigger the vulnerability. A vendor-issued patch was released as of build 20260621 per TWCERT advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote file read in 4MOSAn Management Center (all versions prior to build 20260621) allows any network-reachable attacker to download arbitrary system files via a Relative Path Traversal flaw (CWE-23). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) confirms no authentication, no user interaction, and no special configuration is required to trigger the vulnerability. A vendor-issued patch was released as of build 20260621 per TWCERT advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.