CVE-2007-0888 EXPLOIT
10.0
HIGH · CVSS 2.0 · EPSS 5.1% (pctl 92)
Patch early
A public exploit exists.
Description
Directory traversal vulnerability in the TFTP server in Kiwi CatTools before 3.2.0 beta allows remote attackers to read arbitrary files, and upload files to arbitrary locations, via ..// (dot dot) sequences in the pathname argument to an FTP (1) GET or (2) PUT command.
Scoring
| CVSS | 10.0 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| EPSS | 5.13% — more likely to be exploited than 92% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2007-02-12 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| kiwi enterprises | kiwi cattools |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Kiwi CatTools TFTP 3.2.8 - Directory Traversal | 2007-02-27 |
References
- http://secunia.com/advisories/24103
- http://securityreason.com/securityalert/2236
- http://www.kiwisyslog.com/kb/idx/5/178/article/
- http://www.osvdb.org/33162
- http://www.securityfocus.com/archive/1/459500/100/0/threaded
- http://www.securityfocus.com/archive/1/459933/100/0/threaded
- http://www.securityfocus.com/bid/22490
- http://www.vupen.com/english/advisories/2007/0536
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32398
- http://secunia.com/advisories/24103
- http://securityreason.com/securityalert/2236
- http://www.kiwisyslog.com/kb/idx/5/178/article/
- http://www.osvdb.org/33162
- http://www.securityfocus.com/archive/1/459500/100/0/threaded
- http://www.securityfocus.com/archive/1/459933/100/0/threaded
- http://www.securityfocus.com/bid/22490
- http://www.vupen.com/english/advisories/2007/0536
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32398
→ the Explorer · watch your stack · NVD