A high-severity vulnerability has been identified in multiple MPDV Mikrolab GmbH products, including HYDRA X, MIP 2, and FEDRA 2. This flaw allows an unauthenticated attacker to read arbitrary files from the underlying Windows operating system, potentially exposing sensitive corporate data, system configurations, and credentials. Immediate patching is required to mitigate the risk of a significant data breach.

The vulnerability is an unauthenticated local file disclosure, likely a path traversal flaw. An attacker can exploit this by sending a specially crafted request to a vulnerable component of the application. By manipulating file path parameters with sequences such as ../ or ..\\, the attacker can navigate outside of the intended web directory and access any file on the server's file system that the application's service account has permission to read. This requires no prior authentication, making it a low-complexity attack that can be launched by any remote attacker with network access to the affected system.

This vulnerability is rated as High severity with a CVSS score of 7.5. Successful exploitation could lead to a significant data breach, exposing sensitive information such as intellectual property, financial records, customer data, and system credentials stored in configuration files. The disclosure of such information could result in severe financial loss, reputational damage, regulatory fines, and provide attackers with the necessary information to pivot and launch further attacks against the internal network.

Immediate Action: Apply the vendor-provided security update, Maintenance Pack 36 with Servicepack 8 (week 36/2025) or a later version, to all affected systems immediately. After patching, review application and system access logs for any signs of compromise or exploitation attempts that may have occurred prior to the update.

Proactive Monitoring:

• Log Analysis: Monitor web server and application logs for suspicious requests containing path traversal sequences (e.g., ../, ..\\, %2e%2e%2f) or attempts to access known sensitive file paths (e.g., C:\Windows\win.ini, C:\inetpub\wwwroot\web.config).
• Network Traffic: Monitor for unusual outbound traffic from the affected servers, which could indicate data exfiltration.
• File Integrity Monitoring (FIM): Implement FIM on critical system and application files to detect unauthorized access or read attempts.

Compensating Controls:

• Web Application Firewall (WAF): If immediate patching is not feasible, implement a WAF with a strict ruleset designed to detect and block path traversal attack patterns.
• Principle of Least Privilege: Ensure the service account running the affected application has the most restrictive file system permissions possible, limiting its access to only the directories and files essential for its operation.
• Network Segmentation: Isolate the vulnerable servers from other critical network segments to limit the potential impact of a breach.

Public Exploit Available: false

Given the high CVSS score of 7.5 and the unauthenticated nature of this vulnerability, we strongly recommend that organizations prioritize the immediate deployment of the vendor-supplied patch. The ability for an attacker to read sensitive system files without credentials presents a critical risk of data exposure and further system compromise. Although this vulnerability is not currently listed on the CISA KEV list, it should be treated with the urgency of a critical finding and remediated within the established timeframe for high-severity vulnerabilities.