CVE-2014-125125

CVE-2014-125125 is a high-severity path traversal vulnerability affecting A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier. An unauthenticated attacker can exploit a flaw in the /xml/downloads endpoint's handling of the filename parameter to read arbitrary files and cause unintended file deletion. This vulnerability carries a CVSS score of 8.8 (HIGH) due to its network-based attack vector, low attack complexity, and potential for high confidentiality impact (sensitive information disclosure like SSL certificates) and low integrity/availability impact (file deletion). While not listed on the KEV catalog, public exploit code exists in Metasploit, and there is some community discussion, indicating potential for active exploitation.