Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.8

Personal Weather Station Dashboard 12_lts allows unauthorized access to sensitive files

CVE-2025-47423 · published 1 year ago
Summary

An attacker can access sensitive files on the server without needing a password. This can happen if the server is not properly configured. To fix this, update to a patched version of the software or apply a security patch.

Original advisory text
Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/_test.php, as demonstrated by ...
Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/_test.php, as demonstrated by reading the server's private SSL key in cleartext.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.8 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-24Path Traversal: '../filedir'
Timeline
Published7 May 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-47423 · NVD
Track software like this
Free during beta