The vulnerability is a classic path traversal flaw in Ziostation2, allowing an attacker to craft requests that reference files outside the intended directory. This flaw, identified as CWE‑22, lets a remote unauthenticated attacker retrieve sensitive operating‑system files or configurations, resulting in confidentiality disclosure. No code execution or privilege escalation is explicitly described, so the primary impact is data leakage.

Affected are Ziosoft, Inc.'s Ziostation2 device firmware versions 2.9.8.7 and earlier. The flaw exists in the file‑download handling component exposed over the device’s web interface.

The CVSS score is 8.7, indicating a high severity. With an EPSS score below 1% and no listing in the CISA KEV catalog, exploitation is considered unlikely at present. However, the path traversal can be triggered without authentication, so a potential attacker only needs to send a specially‑crafted request to the device’s web service, which in many cases may be exposed to the Internet.