The vulnerability is a directory traversal flaw in the getadslattr.cgi endpoint of Hisilicon HiIpcam V100R003. An unauthenticated attacker can craft URLs that traverse outside the intended directory and read files within the cgi-bin folder. The flaw enables the retrieval of sensitive assets including ADSL credentials, network configuration, usernames, passwords, and DNS settings, leading to confidentiality loss. The weakness aligns with CWE‑260 as described in the advisory, highlighting exposure of credential information.

Affected systems are devices running the Hisilicon HiIpcam V100R003 firmware. No granular version list is supplied; any installation of this product is presumed vulnerable until verified otherwise.

The CVSS score of 8.7 indicates a high severity vulnerability. EPSS is below 1%, so exploitation is currently considered unlikely, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only unauthenticated HTTP access to the device, so the attack vector is network‑based. The attacker needs only to send a crafted GET request to the vulnerable endpoint; no authentication or additional privileges are needed. Consequently, any network‑exposed device presents a high risk until mitigated.