CVE-2024-41717

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Kieback & Peter's DDC4000 series is vulnerable to a path traversal vulnerability, which may allow an unauthenticated attacker to read files on the system.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
Kieback & PeterDDC4040e<= 1.17.6
Kieback&PeterDDC4020e<= 1.17.6
Kieback&PeterDDC4400e<= 1.17.6
Kieback&PeterDDC4200e<= 1.17.6
Kieback&PeterDDC4002e<= 1.17.6
Kieback&PeterDDC4400<= 1.12.14
Kieback&PeterDDC4200-L<= 1.12.14
Kieback&PeterDDC4200<= 1.12.14
Kieback&PeterDDC4100<= 1.7.4
Kieback&PeterDDC4002<= 1.12.14
kieback\&peterddc4400_firmware<= 1.12.14
kieback\&peterddc4002e_firmware<= 1.17.6
kieback\&peterddc4200e_firmware<= 1.17.6
kieback\&peterddc4002_firmware<= 1.12.14
kieback\&peterddc4100_firmware<= 1.7.4
kieback\&peterddc4200_firmware<= 1.12.14
kieback\&peterddc4200-l_firmware<= 1.12.14
kieback\&peterddc4400e_firmware<= 1.17.6
kieback\&peterddc4020e_firmware<= 1.17.6
kieback\&peterddc4040e_firmware<= 1.17.6

References

Timeline

Published
Oct 22, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-417195.5When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager (CM), F5 iHealth credentials will be logged in the BIG-CVE-2024-41724.3A vulnerability classified as problematic was found in idcCMS 1.35. Affected by this vulnerability is an unknown functionality of the file /CVE-2024-417208.0Incorrect permission assignment for critical resource issue exists in ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15, which may allowCVE-2024-417218.1An insufficient boundary validation in the USB code could lead to an out-of-bounds read on the heap, which could potentially lead to an arbiCVE-2024-417226.5In the goTenna Pro ATAK Plugin there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign usingCVE-2024-417234.3Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names.  Note: Software versions which have reachedCVE-2024-417248.7Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server. CVE-2024-417256.1ProGauge MAGLINK LX CONSOLE does not have sufficient filtering on input fields that are used to render pages which may allow cross site scCVE-2024-417267.5Path traversal vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e. If this vulnerability is exploited, an arbitrary eCVE-2024-417277.5In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition (VEs) using Intel E810 SR-IOV NIC, undisclosed traffCVE-2024-417282.7Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer CVE-2024-417294.3Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is other
CVE-2024-41717: Critical severity, CVSS 9.8 | Vulnix