Path traversal in Digitek ADT1100 and Digitek DT950 allows an attacker to retrieve arbitrary files on the server by manipulating URL encoded traversal sequences. This flaw bypasses the input validation and can expose sensitive system files such as /etc/passwd, leading to information disclosure or further exploitation.

All released versions of Primion Digitek’s Digitek ADT1100 and Digitek DT950 devices are affected. The vulnerability is present across all builds of the two products, as indicated by the CPE all_versions designation.

The vulnerability has a CVSS score of 8.7, indicating high severity, yet the EPSS probability is less than 1%, and it is not listed in the CISA KEV catalog. The likely attack vector is HTTP requests containing URL encoded traversal sequences sent to the device’s web interface. Based on the description, it is inferred that these requests do not require authentication, allowing an attacker to retrieve files outside the intended resource directory.