PT-2025-29140 · Riverbed · Riverbed Steelhead Vcx

Gregory Draperi · Published 2025-07-10 · Updated 2025-07-11 · CVE-2025-34098

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Riverbed SteelHead VCX versions 9.6.0a

Description: A path traversal vulnerability exists due to improper input validation in the log filtering functionality exposed via the management web interface. An authenticated attacker can exploit this flaw by submitting crafted filter expressions to the log filter endpoint using the filterStr parameter. This input is processed by a backend parser that permits execution of file expansion syntax, allowing the attacker to retrieve arbitrary system files via the log viewing interface.

Recommendations: Riverbed SteelHead VCX version 9.6.0a: Implement strict input validation for the filterStr parameter in the log filter endpoint to prevent the use of file expansion syntax.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-34098

Affected Products

Riverbed Steelhead Vcx

References · 7

• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/riverbed_steelhead_vcx_file_read.rb · Exploit
• 🔥 https://exploit-db.com/exploits/42101 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34098 · Security Note
• https://twitter.com/VulmonFeeds/status/1943451228131758183 · Twitter Post
• https://twitter.com/CVEnew/status/1943668206817968481 · Twitter Post
• https://t.me/cvenotify/128438 · Telegram Post
• https://vulncheck.com/advisories/riverbed-steel-head-vcx-authenticated-arbitrary-file-read · Note