The flaw is a classic path traversal vulnerability in the OpenWrt luci-app-bmx7 bmx7-info CGI script, identified as CWE‑22. An attacker who can access the web interface can supply directory traversal sequences in the query string to escape the intended runtime directory and read arbitrary files that the CGI process can reach. This leads to confidentiality loss, potentially exposing configuration files, credentials, or logs. The vulnerability is exploitable by any unauthenticated user with network access to the device.

All releases of the OpenWrt luci-app-bmx7 application prior to commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd are affected. The issue resides in the bmx7-info CGI, which is part of the Luci web interface in the OpenWrt distribution.

The CVSS score of 8.7 classifies the vulnerability as High severity. No EPSS score has been published, and the flaw is currently not listed in CISA's KEV catalog, suggesting limited documented exploitation so far. The likely attack vector involves unauthenticated HTTP requests to the Web UI of the device; an attacker can send crafted query strings containing "../" sequences to access files outside the configured runtime directory. Once directory traversal succeeds, the attacker can read any files readable by the CGI process, resulting in a significant information disclosure risk.