A vulnerability has been reported in A10 Networks AX Series Application Delivery Controllers, which can be exploited by malicious people to disclose certain sensitive information.
Input passed via the "filename" GET parameter to /xml/downloads/ is not properly verified before being used to display files. This can be exploited to disclose the contents of arbitrary files via directory traversal sequences.
The vulnerability is reported in versions (Soft)AX 2.6.1-GR1-P5 and prior and in version 2.7.0 build 217.
Vulnerable Products
Vulnerable OS: A10 Networks AX Series Application Delivery ControllersVulnerable Software:
Solution
Update to version 2.6.1-GR1-P11, 2.7.0-P5, or 2.7.1-P3.
