PT-2025-44397 · Tftpsync · Ftpsync

Paolo Perego · Published 2025-10-28 · Updated 2025-10-30 · CVE-2025-53880

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions tftpsync (affected versions not specified)

Description A path traversal flaw exists in the tftpsync/add and tftpsync/delete scripts. A remote attacker on an adjacent network can potentially write or delete files on the filesystem with the privileges of the wwwrun user. Access to the affected scripts is restricted to a list of allowed IP addresses, and the scripts are unauthenticated. The vulnerability involves manipulating file paths to access resources outside the intended directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-35

Related Identifiers

CVE-2025-53880

SUSE-SU-2025:3827-1

Affected Products

Ftpsync

References · 13

• https://osv.dev/vulnerability/SUSE-SU-2025:3827-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53880 · Security Note
• https://twitter.com/CVEnew/status/1983849783145197823 · Twitter Post
• https://suse.com/support/update/announcement/2025/suse-su-20253827-1 · Note
• https://suse.com/security/cve/CVE-2025-53880 · Note
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53880 · Note
• https://t.me/CVEtracker/36177 · Telegram Post
• https://suse.com/security/cve/CVE-2025-53883 · Note
• https://bugzilla.suse.com/1246439 · Note
• https://bugzilla.suse.com/1248252 · Note
• https://bugzilla.suse.com/1246277 · Note
• https://suse.com/security/cve/CVE-2025-53192 · Note
• https://t.me/cveNotify/140935 · Telegram Post