CVE-2021-4459

Published: Aug 27, 2025Modified: Jun 17, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: info@cert.vde.com (Secondary)

Description

An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system information of the affected Sunny Boy devices.

Related CWEs

CWE-23

Relative Path Traversal

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

References (1)

https://certvde.com/en/advisories/VDE-2025-066

Source: info@cert.vde.com

Timeline

No history available yet.