CVE-2024-6445 is a CWE-22 path traversal vulnerability in DataFlowX Technology's DataDiodeX product versions 3.0.0 through before 3.1.7. The vulnerability arises from improper limitation of pathnames to restricted directories, allowing attackers to access unauthorized files or directories. The vulnerability has a CVSS 4.0 score of 10.0, reflecting critical severity with network-based exploitation possible without privileges or user interaction, and severe impacts on confidentiality, integrity, availability, and security. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor patch releases.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to perform path traversal attacks, potentially accessing or modifying sensitive files outside intended directories. This could lead to full compromise of confidentiality, integrity, and availability of the affected system. The critical CVSS score reflects the high impact and ease of exploitation over the network without any required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected DataDiodeX instances and monitor for unusual file access patterns. Do not rely on generic mitigations as the vendor has not provided specific recommendations yet.