Description
Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to read any file or list any directory accessible to the system user running the web server. This is possible by modifying the URL to include a path traversal payload. Successful exploitation of this vulnerability could allow an attacker to access critical system files containing confidential information.
Published: 2026-10-07
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized File Disclosure
Action: Apply Patch
AI Analysis

Impact

A path traversal issue exists in the web portal of the SenNet Datalogger Serie 200, allowing an authenticated user to modify the URL and access any file or directory readable by the web server process. Successful exploitation would give the attacker read access to system files that may contain confidential data.

Affected Systems

The vulnerability affects Satel Iberia’s SenNet Datalogger Serie 200, specifically firmware versions up to V7.0m-1.53h. Satel Iberia has released a fix in version V7.2a.

Risk and Exploitability

The CVSS score of 7.1 indicates high severity, but the EPSS score is not available, so the probability of exploitation is unknown. Because the flaw requires valid authentication to the web portal, the risk is confined to users who can log in. If an attacker gains authenticated access, they could read any file under the web server’s privilege level, potentially exposing sensitive system configuration and other confidential information.

Generated by OpenCVE AI on October 7, 2026 at 10:41 UTC.

Remediation

Vendor Solution

The vulnerability has been fixed by Satel Iberia team in version V7.2a.

OpenCVE Recommended Actions

  • Upgrade the SenNet Datalogger to firmware V7.2a or later to patch the path traversal flaw.
  • Restrict web portal access so that only trusted devices or users with necessary privileges can authenticate, and limit the web server’s operational directory and file permissions.
  • If remote access to the web portal is unnecessary, consider disabling it or placing the device on a separate network segment, and monitor logs for suspicious path traversal attempts.

Generated by OpenCVE AI on October 7, 2026 at 10:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 07 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to read any file or list any directory accessible to the system user running the web server. This is possible by modifying the URL to include a path traversal payload. Successful exploitation of this vulnerability could allow an attacker to access critical system files containing confidential information.
Title Path Traversal in Satel Iberia SenNet Datalogger Serie 200
First Time appeared Satel Iberia
Satel Iberia sennet Datalogger Serie 200
Weaknesses CWE-35
CPEs cpe:2.3:a:satel_iberia:sennet_datalogger_serie_200:v7.0m-1.53h:*:*:*:*:*:*:*
Vendors & Products Satel Iberia
Satel Iberia sennet Datalogger Serie 200
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Satel Iberia Sennet Datalogger Serie 200
cve-icon MITRE

Status: PUBLISHED

Assigner: INCIBE

Published:

Updated: 2026-10-07T08:35:00.317Z

Reserved: 2026-04-06T12:50:25.930Z

Link: CVE-2026-5703

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-07T09:17:05.673

Modified: 2026-10-07T14:47:35.590

Link: CVE-2026-5703

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T10:45:07Z

Weaknesses
  • CWE-35

    Path Traversal: '.../...//'