PT-2025-42221 · Unknown · Huijietong Cloud Video Platform

Cn-Sec · Published 2025-10-15 · Updated 2025-11-03 · CVE-2024-13991

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Huijietong Cloud Video Platform (affected versions not specified)

Description The platform contains a path traversal issue that allows unauthenticated attackers to retrieve files from the server filesystem. This is achieved by manipulating the fullPath parameter within the /fileDownload?action=downloadBackupFile API endpoint. The Rondo botnet has been observed targeting this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-13991

Affected Products

Huijietong Cloud Video Platform

References · 9

• 🔥 https://cn-sec.com/archives/2941393.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-13991 · Security Note
• https://twitter.com/VulmonFeeds/status/1978343347065377073 · Twitter Post
• https://twitter.com/CVEnew/status/1978562107005186199 · Twitter Post
• https://t.me/cveNotify/138779 · Telegram Post
• https://vulncheck.com/advisories/huijietong-cloud-video-platform-filedownload-arbitrary-file-read · Note
• https://twitter.com/CveFindCom/status/1978281991096119555 · Twitter Post
• https://t.me/CVEtracker/34932 · Telegram Post
• https://t.me/cveNotify/141348 · Telegram Post