The vulnerability exists in the embedded web interface of JUNG Smart Panel 5.1 KNX firmware L1.12.22 and earlier. The application does not validate file path input, enabling an attacker to supply a specially crafted URL that traverses directories and reads arbitrary files. An attacker can read configuration files and other sensitive data stored on the device’s underlying filesystem, potentially revealing credentials, network topology, or other confidential information. The weakness is a classic path traversal flaw (CWE-22).

Vendors: ALBRECHT JUNG GMBH & CO. KG; Product: JUNG Smart Panel 5.1 KNX; Affected firmware versions: L1.12.22 and prior.

The CVSS base score is 6.9, indicating moderate severity. EPSS evaluates the likelihood of exploitation as less than 1%, meaning that while exploitation is technically feasible, it is considered rare at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no public exploit has been confirmed. Attackers would need remote network access to the device’s web interface and no authentication is required, which increases the ease of exploitation. Overall, the risk is moderate but increases if the device is exposed to untrusted networks.