An unauthenticated information disclosure vulnerability in the RED-V Super Digital Signage System 5.1.1 allows remote attackers to access sensitive logs and system resources, posing a significant security risk.

The application is susceptible to a directory listing vulnerability (CWE-548) that permits unauthenticated remote attackers to enumerate and retrieve sensitive webserver log files and debug information from the system. This occurs because the webserver configuration fails to restrict access to directory contents or sensitive files, allowing unauthorized exposure of internal system data.

The exposure of webserver logs and system resources can lead to the compromise of sensitive operational data, including internal file paths, configuration details, and potentially session identifiers or credentials stored within logs. This information disclosure provides attackers with the necessary reconnaissance to facilitate more advanced attacks against the infrastructure. Given the CVSS score of 7.5, this vulnerability represents a high risk to the confidentiality and integrity of the affected signage network.

Immediate Action: Since a specific patch is currently unknown, administrators should immediately restrict network access to the affected devices by placing them behind a firewall or VPN, ensuring they are not accessible from the public internet.

Proactive Monitoring: Review webserver and system access logs for anomalous requests, specifically targeting patterns of directory traversal or bulk file enumeration attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access to log directories and debug endpoints, which can serve as a virtual patch until an official software update is released.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the Packet Storm Security reference.

This vulnerability presents a high risk due to the ease of exploitation and the potential for sensitive data exposure. Organizations utilizing the RED-V Super Digital Signage System should prioritize network segmentation and the implementation of compensating controls immediately. Monitor for vendor communications regarding a security update and apply it as soon as it becomes available to remediate the underlying flaw.