This vulnerability involves a path traversal flaw in Oinone Pamirs (versions 7.0 through 7.2.0) specifically in the request.getParameter method of LocalFileClient.java in the RestController component. By manipulating the uniqueFileName parameter, an attacker with limited privileges can perform path traversal attacks on the physical device. The vulnerability has been publicly disclosed and proof-of-concept exploit code is available. The vendor has not issued any response or patch to address this issue.

The vulnerability allows an attacker with local privileges to manipulate file paths via the uniqueFileName parameter, potentially accessing files outside the intended directory. Given the low CVSS score (2.4) and the requirement for local access, the impact is limited. There are no known exploits in the wild. The vendor has not provided any official fix or mitigation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should restrict local access to trusted users only and monitor for any suspicious activity related to file access. Avoid exposing the affected component to untrusted users until a fix is released.