PT-2025-20287 · Unknown · Pws Personal Weather Station Dashboard

Matthew Eagle · Published 2025-05-07 · Updated 2025-06-22 · CVE-2025-47423

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Personal Weather Station Dashboard version 12 lts

Description The issue allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to "/others/ test.php". This can be exploited to read sensitive files, such as the server's private SSL key in cleartext.

Recommendations For Personal Weather Station Dashboard version 12 lts, restrict access to the "/others/ test.php" endpoint to prevent directory traversal attacks, and avoid using the test parameter until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-24

Related Identifiers

CVE-2025-47423

Affected Products

Pws Personal Weather Station Dashboard

References · 7

• 🔥 https://github.com/haluka92/CVE-2025-47423 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-47423 · Security Note
• https://t.me/cvetracker/23290 · Telegram Post
• https://t.me/cvedetector/24737 · Telegram Post
• https://twitter.com/CVEnew/status/1920246455471571142 · Twitter Post
• https://pwsdashboard.com · Note
• https://twitter.com/pdnuclei_bot/status/1936725861371445481 · Twitter Post