This vulnerability involves a path traversal flaw in the Fireware OS WebUI management agent that enables an authenticated administrator to access arbitrary files on the local filesystem. Exploitation is achieved by sending a specially crafted management request that bypasses normal file access restrictions. The vulnerability is identified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The CVSS 4.0 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, with no impact on integrity or availability.

An authenticated administrator can read or list any file on the local filesystem, potentially exposing sensitive configuration or credential files. This could lead to information disclosure within the affected system. There is no indication of remote unauthenticated exploitation or impact on system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, administrators should monitor vendor communications for updates. Until a fix is available, restrict administrative access to trusted personnel and networks.