Pro-Bit versions prior to 1.77.4 are vulnerable to an unauthenticated directory traversal attack that permits unauthorized access to sensitive system data.

The vulnerability is a directory traversal flaw that allows unauthenticated remote attackers to bypass access controls and directly retrieve files from sensitive directories and their subdirectories.

This vulnerability poses a significant risk to data confidentiality, as it enables unauthorized parties to view sensitive information without requiring credentials. Given the 7.5 CVSS score, this is classified as a High severity issue that could lead to the exposure of configuration files, credentials, or proprietary data, potentially resulting in regulatory non-compliance or loss of intellectual property.

Immediate Action: Organizations should restrict access to the affected Pro-Bit instance via network controls and prioritize updating the software to version 1.77.4 or later immediately upon vendor release.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing path traversal patterns, such as dot-dot-slash sequences, targeting sensitive directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to block directory traversal attempts and normalize URI inputs to prevent malicious path manipulation.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository hosted at https://github.com/jasetpen/CVE-2025-69428.

The presence of a public proof-of-concept increases the likelihood of exploitation by malicious actors. Administrators must treat this as a priority, ensuring that any exposed Pro-Bit interfaces are secured behind a VPN or WAF until the software can be updated to the patched version.