CVE-2024-5433: Path Traversal in Campbell Scientific CSI Web Server and RTMC

Severity: medium (CVSS 5.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-28 · updated 2026-06-17
Weakness: CWE-22

Description

The Campbell Scientific CSI Web Server supports a command that will return the most recent file that matches a given expression. A specially crafted expression can lead to a path traversal vulnerability. This command combined with a specially crafted expression allows anonymous, unauthenticated access (allowed by default) by an attacker to files and directories outside of the webserver root directory they should be restricted to.

Affected products

Campbell Scientific CSI Web Server and RTMC: CSI Web Server 1.6, RTMC 5.0

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-149-01
https://www.cisa.gov/news-events/ics-advisories/icsa-24-149-01

Get alerted when CVE-2024-5433 or the next vulnerability affects your stack