CVE-2025-24494: Path Traversal RCE Vulnerability

CVE-2025-24494 Overview

CVE-2025-24494 is a path traversal vulnerability affecting Keysight Ixia products that may allow remote code execution when exploited by a privileged (device admin) account. The vulnerability requires administrative privileges and cannot be performed by a regular user. When combined with the upload functionality, an attacker with admin access can leverage the path traversal flaw to execute arbitrary scripts or uploaded binaries on the affected system.

This vulnerability represents a serious security concern for industrial control system (ICS) environments where Keysight Ixia network testing and visibility products are deployed. CISA has issued an ICS advisory (ICSA-25-063-02) regarding this vulnerability.

Critical Impact

Administrative users can achieve remote code execution through path traversal combined with file upload capabilities, potentially leading to full system compromise.

Affected Products

• Keysight Ixia products (versions prior to 6.7.0)
• Network testing and visibility solutions from Ixia/Keysight

Discovery Timeline

• 2025-03-05 - CVE CVE-2025-24494 published to NVD
• 2025-03-05 - Last updated in NVD database
• 2024-10-20 - Keysight releases security patch in Version 6.7.0

Technical Details for CVE-2025-24494

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal or Directory Traversal. The flaw exists in how the application handles file path inputs, failing to properly sanitize directory traversal sequences such as ../ before processing file operations.

When an authenticated administrator uses the upload functionality, the application does not adequately validate the destination path. This allows an attacker with admin credentials to navigate outside the intended directory structure and place files in arbitrary locations on the file system. By uploading malicious scripts or binaries to executable locations, the attacker can achieve code execution with the privileges of the application.

The attack requires network access and high-privilege credentials (device administrator), which somewhat limits the attack surface. However, in scenarios where admin credentials are compromised or where insider threats exist, this vulnerability provides a direct path to code execution.

Root Cause

The root cause of CVE-2025-24494 is insufficient input validation on file path parameters within the upload functionality. The application fails to properly sanitize or restrict path components before using them in file system operations. Specifically, the code does not:

• Normalize and validate file paths against a restricted base directory
• Strip or reject directory traversal sequences (e.g., ../, ..\\)
• Implement proper allowlisting of permitted upload destinations

This allows path manipulation characters to escape the intended upload directory and write files to arbitrary locations accessible by the application's user context.

Attack Vector

The attack is conducted over the network and requires:

1. Valid administrative credentials - The attacker must possess device admin account access
2. Network connectivity - Access to the management interface of the vulnerable device
3. Two-stage exploitation - First exploiting the path traversal to identify or access a writable/executable location, then using the upload function to place a malicious payload

An attacker would craft an upload request with a manipulated file path containing traversal sequences. For example, a path like ../../executable_directory/malicious_script could place content outside the intended upload directory. Once the malicious script or binary is in place, execution could occur through various means depending on the system configuration, such as scheduled tasks, service restarts, or direct invocation.

Detection Methods for CVE-2025-24494

Indicators of Compromise

• Unexpected files appearing in system directories outside normal upload locations
• Log entries showing file upload requests with directory traversal sequences (../ or encoded variants)
• Newly created or modified scripts or binaries in executable directories
• Unusual process execution originating from non-standard locations

Detection Strategies

• Monitor web application logs for path traversal patterns in upload requests, including encoded sequences like %2e%2e%2f
• Implement file integrity monitoring on critical system directories to detect unauthorized file creation or modification
• Review administrative account usage and correlate with file upload activities for anomalous behavior
• Deploy network intrusion detection rules to identify path traversal attempts in HTTP traffic

Monitoring Recommendations

• Enable detailed logging on the affected Keysight Ixia devices for all file upload operations
• Implement centralized log collection and alerting for path traversal indicators
• Monitor for execution of scripts or binaries from unexpected filesystem locations
• Review administrative access logs for any unauthorized or unusual login patterns

How to Mitigate CVE-2025-24494

Immediate Actions Required

• Upgrade affected Keysight Ixia products to Version 6.7.0 or later immediately
• Audit administrative account usage and enforce strong credential policies
• Review and restrict network access to management interfaces using firewalls or VLANs
• Implement the principle of least privilege for all administrative accounts

Patch Information

Keysight has addressed this vulnerability in Version 6.7.0, released on October 20, 2024. Organizations should download the latest firmware or software updates from the IxiaCom Product Downloads page. For additional support, contact Keysight through their official contact page.

The CISA ICS Advisory ICSA-25-063-02 provides additional guidance for industrial control system environments.

Workarounds

• Restrict administrative account access to trusted personnel only and implement multi-factor authentication where possible
• Segment the network to limit access to device management interfaces from untrusted networks
• Monitor and alert on file upload activities performed by admin accounts
• Consider implementing web application firewall rules to block requests containing path traversal patterns