Thermo Fisher
Monthly
Authenticated path traversal in Thermo Fisher Torrent Suite Software lets a user who already holds a valid low-privilege session on the Torrent Server web interface read arbitrary files that are accessible to the web service account. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), impact is confidentiality-only - no write, integrity, or code-execution effect - and the readable scope is bounded by the filesystem permissions of the web service account, so it cannot reach files that account cannot access. No public exploit code or confirmed active exploitation was identified at time of analysis, and the authentication prerequisite confines realistic risk to insiders or attackers who have already obtained credentials; this is a moderate-priority information-disclosure issue rather than a critical emergency. CISA published an ICS medical advisory (ICSMA-26-288-01) covering this flaw.
Authenticated path traversal in Thermo Fisher Torrent Suite Software lets a user who already holds a valid low-privilege session on the Torrent Server web interface read arbitrary files that are accessible to the web service account. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), impact is confidentiality-only - no write, integrity, or code-execution effect - and the readable scope is bounded by the filesystem permissions of the web service account, so it cannot reach files that account cannot access. No public exploit code or confirmed active exploitation was identified at time of analysis, and the authentication prerequisite confines realistic risk to insiders or attackers who have already obtained credentials; this is a moderate-priority information-disclosure issue rather than a critical emergency. CISA published an ICS medical advisory (ICSMA-26-288-01) covering this flaw.