CVE-2024-6445: Authenticated Local File Inclusion (LFI) in DataFlowX's DataDiodeX

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-06 · updated 2026-06-17
Weakness: CWE-22

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DataFlowX Technology DataDiodeX allows Path Traversal. This issue affects DataDiodeX: from v3.0.0 before v3.1.7.

Affected products

DataFlowX Technology DataDiodeX: from 3.0.0 before 3.1.7 — fixed in 3.1.7

How to fix

Upgrade to a fixed version: DataFlowX Technology DataDiodeX 3.1.7. Check the vendor advisory for mitigations.

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1409
https://www.usom.gov.tr/bildirim/tr-24-1409

Get alerted when CVE-2024-6445 or the next vulnerability affects your stack