Oaklouds Bulletin V3 3 0
Monthly
Unauthenticated relative path traversal in HGiga OAKlouds Bulletin V3 (2.0 and 3.0 product lines, module builds below 107) lets remote attackers read arbitrary files from the underlying host, potentially exposing configuration files, stored credentials, and other sensitive system data. Both the published CVSS 4.0 score of 8.7 and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) agree that no authentication, no user interaction, and no non-default configuration are required - the only prerequisites are network reachability of the Bulletin web interface and a vulnerable build. No public exploit identified at time of analysis, and the vendor has released a fix in build 107, so residual risk hinges on whether internet-facing or partner-exposed deployments have actually been upgraded. This is a genuinely high-priority issue given the unauthenticated, confidentiality-only but high-impact nature of the flaw and the often sensitive content of Taiwanese bulletin/portal deployments.
Unauthenticated relative path traversal in HGiga OAKlouds Bulletin V3 (2.0 and 3.0 product lines, module builds below 107) lets remote attackers read arbitrary files from the underlying host, potentially exposing configuration files, stored credentials, and other sensitive system data. Both the published CVSS 4.0 score of 8.7 and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) agree that no authentication, no user interaction, and no non-default configuration are required - the only prerequisites are network reachability of the Bulletin web interface and a vulnerable build. No public exploit identified at time of analysis, and the vendor has released a fix in build 107, so residual risk hinges on whether internet-facing or partner-exposed deployments have actually been upgraded. This is a genuinely high-priority issue given the unauthenticated, confidentiality-only but high-impact nature of the flaw and the often sensitive content of Taiwanese bulletin/portal deployments.