CVE-2024-6049: Unauthenticated Path Traversal

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-10-24 · updated 2026-06-17
Weakness: CWE-32

Description

The web server of Lawo AG vsm LTC Time Sync (vTimeSync) is affected by a "..." (triple dot) path traversal vulnerability. By sending a specially crafted HTTP request, an unauthenticated remote attacker could download arbitrary files from the operating system. As a limitation, the exploitation is only possible if the requested file has some file extension, e. g. .exe or .txt.

Affected products

Lawo Vsm Ltc Timesync: all versions

References

https://lawo.com/lawo-downloads/
https://r.sec-consult.com/lawo
http://seclists.org/fulldisclosure/2024/Oct/7

Get alerted when CVE-2024-6049 or the next vulnerability affects your stack