CVE-2025-34047 | THREATINT

Description

A path traversal vulnerability exists in the Leadsec SSL VPN (formerly Lenovo NetGuard), allowing unauthenticated attackers to read arbitrary files on the underlying system via the ostype parameter in the /vpn/user/download/client endpoint. This flaw arises from insufficient input sanitation, enabling traversal sequences to escape the intended directory and access sensitive files.

Reserved 2025-04-15 | Published 2025-06-26 | Updated 2025-06-26 | Assigner VulnCheck

HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-20 Improper Input Validation

Product status

Default status

unaffected

Any version

affected

References

www.cnvd.org.cn/flaw/show/CNVD-2021-64035 third-party-advisory

github.com/.../blob/main/http/cnvd/2021/CNVD-2021-64035.yaml exploit

www.leadsec.com.cn/ product

vulncheck.com/...sories/leadsec-vpn-path-traversal-file-read third-party-advisory

cve.org (CVE-2025-34047)

nvd.nist.gov (CVE-2025-34047)

Download JSON