CVE-2025-7096: Unauthorized Path Traversal in WTI Web Management Interface with POC

CVE-2025-7096 — Unauthorized Path Traversal Vulnerability in WTI Web Management Interface (Camera Control) Vulnerability Overview The web management interface of WTI (Wireless Technology, Inc.) Camera Control version 3.5.0.r (built on May 24, 2024) contains an unauthorized path traversal vulnerability. Attackers can construct malicious HTTP requests containing traversal sequences ( ) to access files outside the intended web root directory. This allows the leakage of sensitive system files and configuration data, potentially leading to privilege escalation. Affected Scope Vendor: WTI (Wireless Technology, Inc.), USA Product: WTI Web Management Interface Component: Camera Control Interface Affected Versions: Camera Control 3.5.0.r (built on May 24, 2024) Vulnerability Details Type: Directory Traversal / Local File Inclusion (LFI) CWE: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Authentication: None (Unauthorized) Attack Type: Remote Attack Vector: Network (HTTP) Impact: Information Disclosure; Privilege Escalation (Downstream Impact) CVSS 3.1: 7.5 (High) Proof of Concept (POC) Replace with the address of the affected device. A successful request will return the contents of , confirming that the interface serves files from outside the expected root directory. The same technique can be used to target configuration files or credential stores on the device. Impact An unauthorized, remote attacker can: Read sensitive system files (e.g., , service configurations) Access configuration data and stored credentials Escalate privileges or lateral move within the connected environment using recovered credentials/configurations The ultimate effect is information disclosure, with a realistic path to privilege escalation. Mitigations Apply vendor-provided firmware/software updates (once available). Restrict access to the web management interface using network controls (Management VLANs, ACLs, VPN-only access). Implement strong authentication and restrict management access. Disable the web interface if not required. Monitor device logs for suspicious file access activities and traversal patterns (sequences like in request paths). Disclosure Timeline 2025-12-29: Vulnerability discovered 2026-02-04: CVE-2025-7096 assigned by MITRE YYYY-MM-DD: Public disclosure References CWE-22: https://cwe.mitre.org/data/definitions/22.html Repository/Write-up: https://github.com/LPO26/Path-Traversal-via-Web-Interface-on-WTI-Devices Vendor Advisory: (To be added after release)

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-7096: Unauthorized Path Traversal in WTI Web Management Interface with POC

More from this source