CVE-2021-45783

Vulnerability

A directory traversal vulnerability exists in Bookeen Notea firmware version BK_R_1.0.5_20210608. The flaw allows an attacker to read arbitrary files on the device by manipulating file path parameters, bypassing intended access restrictions [1][2].

Exploitation

An attacker with network access to the device can exploit this by sending crafted HTTP requests containing path traversal sequences (such as ../) in file-related parameters. No authentication is required, and the attack can be performed remotely without user interaction [1][2].

Impact

Successful exploitation leads to unauthorized disclosure of sensitive information, including configuration files, user data, and other system files stored on the device. This compromises the confidentiality of the device and potentially exposes credentials or other secrets [1][2].

Mitigation

As of the publication date (2022-05-05), no patched firmware version has been released. Users should monitor the vendor for updates and restrict network access to the device until a fix is applied [1][2].