An unauthenticated arbitrary file read vulnerability in Sunnet WMPro poses a high risk of sensitive data exposure and system compromise.

This vulnerability is a relative path traversal flaw (CWE-23) that allows an unauthenticated remote attacker to bypass file access restrictions and read arbitrary files on the underlying system.

The ability for an unauthenticated user to read arbitrary system files can lead to the exposure of configuration files, credentials, or sensitive application data. With a CVSS score of 7.5, this high-severity vulnerability could facilitate further exploitation or complete system compromise, resulting in significant reputational and operational damage.

Immediate Action: Contact the vendor immediately to obtain and install the necessary security patches and ensure system settings are hardened against path traversal.

Proactive Monitoring: Review web server and application access logs for suspicious patterns, such as sequences containing dot-dot-slash (../) characters targeting sensitive directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts to provide a layer of virtual patching while vendor updates are pending.

Public Exploit Available: No (exploit_available: false).

Given the high severity and the potential for unauthenticated access to sensitive system files, organizations running affected versions of Sunnet WMPro must prioritize this issue. Administrators should work directly with the vendor to secure their deployments and implement strict input validation controls to prevent traversal attacks until a permanent patch is verified and applied.