A path traversal vulnerability in OpenWrt luci-app-bmx7 allows unauthenticated remote attackers to read sensitive files from the underlying system.

The vulnerability exists within the bmx7-info CGI script, which fails to properly sanitize user input, leading to a path traversal (CWE-22) condition. This flaw allows an unauthenticated attacker to escape the designated runtime directory and access arbitrary files on the system.

Successful exploitation allows for the disclosure of sensitive configuration files, system credentials, or other restricted data residing on the device. This breach of confidentiality can facilitate further lateral movement or complete takeover of the affected networking equipment, justifying the high CVSS score of 7.5.

Immediate Action: Update the luci-app-bmx7 package to the version containing commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd or later.

Proactive Monitoring: Audit system logs for directory traversal patterns, such as sequences of double dots and slashes (../), in URL requests targeting CGI scripts.

Compensating Controls: Restrict access to the management interface of the OpenWrt device to trusted network segments or use a WAF to block requests containing path traversal payloads.

Public Exploit Available: Unknown.

This vulnerability presents a clear risk to sensitive system data. Administrators should verify their current commit version and apply the update immediately to prevent unauthorized file disclosure and potential system compromise.