CVE-2026-1523: Path Traversal in Digitek from Grupo Azkoyen

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-05 · updated 2026-06-17
Weakness: CWE-22

Description

Path Traversal vulnerability in Digitek ADT1100 and Digitek DT950 from PRIMION DIGITEK, S.L.U (Azkoyen Group). This vulnerability allows an attacker to access arbitrary files in the server's file system, thet is, 'http://<host>/..%2F..% 2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd'. By manipulating the input to include URL encoded directory traversal sequences (e.g., %2F representing /), an attacker can bypass the input validation mechanisms ans retrieve sensitive files outside the intended directory, which could lead to information disclosure or further system compromise.

Affected products

PRIMION DIGITEK Digitek ADT1100: all versions
PRIMION DIGITEK Digitek DT950: all versions

References

https://www.incibe.es/en/incibe-cert/notices/aviso/path-traversal-digitek-grupo-azkoyen

Get alerted when CVE-2026-1523 or the next vulnerability affects your stack