CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2025-4078Public Exploit

SecGate 3600 - Path Traversal (CVE-2025-4078)

PublishedApr 29, 2025
First SeenN/A
Last Seen
Reported
CVSS5.3
W
WangshenSecGate 3600
firewall

Description

Wangshen SecGate 3600 has been found to have a path traversal vulnerability affecting the processing of the file ?g=log_export_file. The manipulation of the argument file_name leads to path traversal, allowing attackers to read arbitrary files on the system.

psychologyCrowdSec Analysis

CVE-2025-4078 is a path traversal vulnerability in Wangshen SecGate 3600 version 2400. The ?g=log_export_file endpoint fails to properly sanitize the file_name parameter, allowing authenticated attackers to use directory traversal sequences to read arbitrary files on the system, such as /etc/passwd.

CrowdSec has been tracking this vulnerability and its exploits since 18th of March 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-4078 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers send a GET request to /?g=log_export_file with the file_name parameter set to a directory traversal payload such as ../../../../../../../etc/passwd to read arbitrary system files.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2025-04-29
Rule Released2026-03-18

Related Weaknesses

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References