The iVEC-IEI Virtualization Edge Computer by IEI Integration Corp contains an arbitrary file read flaw that permits privileged remote attackers to access system files outside the intended directory boundaries. The vulnerability is a pathname traversal bug (CWE‑22) that leaks sensitive files, potentially exposing confidential system configuration and user data. The impact is the unauthorized disclosure of files but does not provide code execution or arbitrary write capabilities.

All installations of the iVEC TANK‑XM811 product of IEI Integration Corp are affected, specifically versions earlier than v1.0.4. The vendor recommends updating to v1.0.4 or later to remediate the flaw.

The CVSS score of 6.9 indicates a medium severity level. No EPSS score is available, so the exploitation probability cannot be quantified, and the vulnerability is not currently listed in the CISA KEV catalog. The flaw requires remote privileged access, meaning an attacker who can authenticate with sufficient rights can exploit the path traversal to read any file on the host. This makes it a significant threat in environments where remote management interfaces are exposed without strict access controls.