CVE-2008-1620 describes a directory traversal vulnerability in the 2X TFTP service (TFTPd.exe) within 2X ThinClientServer versions 5.0_sp1-r3497 and earlier. This flaw allows remote, unauthenticated attackers to read or overwrite arbitrary files on the server by including "..." (dot dot dot) sequences in filenames during TFTP operations. With a CVSS score of 7.5, this vulnerability is considered high severity, indicating a low attack complexity and the potential for complete compromise of confidentiality, integrity, and availability. The FAUCET Risk Score of 91/100 further emphasizes its critical nature. While not listed in the KEV catalog or experiencing active exploitation, public exploit code exists via ExploitDB (EDB-31562). Despite this, there is minimal community discussion or media coverage surrounding this older vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.2.0.0CPE matchmatch criteria | cpe:2.3:a:2x:thinclientserver:*:*:*:*:*:*:*:* | ||
<= 5.0CPE matchmatch criteria | cpe:2.3:a:2x:thinclientserver:*:sp1_r3497:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:P/I:P/A:P
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.