CVE-2025-47423 is a path traversal vulnerability identified in version 12_lts of the Personal Weather Station Dashboard (pwsdashboard) software. This vulnerability arises due to improper sanitization of the 'test' parameter in the /others/_test.php endpoint, allowing unauthenticated remote attackers to manipulate the file path by including '../' sequences. Exploiting this flaw enables attackers to read arbitrary files on the server's filesystem. A notable demonstration of this exploit is the ability to read the server's private SSL key in cleartext, which is a critical security asset. The vulnerability is classified under CWE-24 (Improper Restriction of File Name in a Pathname), indicating a failure to properly restrict file path inputs. The CVSS v3.1 base score is 5.8 (medium severity), with the vector indicating network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and scope changed (S:C). The impact primarily affects confidentiality, as attackers can access sensitive files without authentication, but does not affect integrity or availability. No known exploits are reported in the wild as of the publication date (May 7, 2025). No patches are currently linked, suggesting that remediation may require vendor action or manual mitigation. The vulnerability's exploitation is straightforward due to lack of authentication and low complexity, making it a significant concern for deployments of this software, especially where sensitive data is stored on the server.

For European organizations using the Personal Weather Station Dashboard 12_lts, this vulnerability poses a significant risk to the confidentiality of sensitive information. The ability to read arbitrary files, including private SSL keys, can lead to further compromise such as man-in-the-middle attacks, decryption of encrypted communications, and unauthorized access to internal systems. Organizations relying on this software for weather data collection or integration may inadvertently expose critical infrastructure or private data. Given the GDPR and other stringent data protection regulations in Europe, unauthorized disclosure of sensitive data could result in regulatory penalties and reputational damage. Additionally, if the server hosts other sensitive files or credentials, attackers could leverage this access to escalate privileges or move laterally within the network. The medium CVSS score reflects the moderate but tangible risk, especially since exploitation requires no authentication and can be performed remotely. The absence of known exploits in the wild currently reduces immediate risk but does not eliminate the threat, as attackers could develop exploits rapidly once the vulnerability is public.

To mitigate this vulnerability, European organizations should first verify if they are running the affected version (12_lts) of the Personal Weather Station Dashboard. Immediate steps include restricting external access to the /others/_test.php endpoint via network controls such as firewalls or web application firewalls (WAFs) to block suspicious path traversal patterns (e.g., '../'). Implement input validation and sanitization on the 'test' parameter to disallow directory traversal sequences. If vendor patches become available, apply them promptly. In the absence of patches, consider disabling or removing the vulnerable endpoint if it is not essential for operations. Additionally, audit the server for exposure of sensitive files and rotate any potentially compromised credentials or keys, especially SSL private keys. Employ monitoring and alerting for unusual file access patterns and conduct regular vulnerability assessments. Finally, segment the network to limit the impact of potential breaches and ensure that sensitive files are stored with strict access controls and encryption at rest.