CVE-2025-47423 - Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/_test.php, as demonstrated by reading the server's private SSL key in cleartext

Back Back to CVE browser

MEDIUM

Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/_test.php, as demonstrated by reading the server's private SSL key in cleartext

Published May 7, 2025

5.8

MEDIUM

CVSS 3.1

EPSS 1.98%

Description

Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/_test.php, as demonstrated by reading the server's private SSL key in cleartext.

Affected products

Vendor Pwsdashboard Product Personal Weather Station Dashboard Default
unknown
Affected
- 12_lts

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Pwsdashboard	Personal Weather Station Dashboard	unknown	Affected 12_lts

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-24

References (3)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-13912		Advisory
https://github.com/haluka92/CVE-2025-47423
https://pwsdashboard.com/

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published May 7, 2025

Updated May 7, 2025

Reserved May 7, 2025

Link CVE-2025-47423

CISA Vulnrichment

Updated May 7, 2025

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-47423

Red Hat

No data

ENISA EUVD

Assigner mitre

Published May 7, 2025

Updated May 7, 2025

Link EUVD-2025-13912

GitHub

No data