CVE-2025-2982: Legrand SMS PowerView Path Traversal Flaw

CVE-2025-2982 Overview

CVE-2025-2982 is a file inclusion vulnerability affecting Legrand SMS PowerView 1.x. The flaw resides in an unspecified function that processes the redirect parameter without proper validation. Attackers can manipulate this parameter to include unauthorized files on the target system. Exploitation occurs remotely over the network and requires low-level privileges. The vendor was contacted prior to public disclosure but did not respond. The vulnerability is tracked under [CWE-73] (External Control of File Name or Path).

Critical Impact
Remote attackers holding low-privilege access can manipulate the redirect parameter to trigger file inclusion, potentially exposing sensitive files or influencing application execution flow on Legrand SMS PowerView 1.x deployments.

Affected Products

Legrand SMS PowerView 1.x

Discovery Timeline

2025-03-31 - CVE-2025-2982 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2982

Vulnerability Analysis

The vulnerability affects an unidentified function within Legrand SMS PowerView 1.x. The application accepts a redirect parameter from remote HTTP clients and uses the supplied value to reference a file resource without sufficient validation. This behavior allows attackers to influence which file the application loads or references. The public disclosure indicates the exploit is available and may already be circulating.

Root Cause

The root cause is external control of a file name or path, classified as [CWE-73]. The application trusts user-supplied input in the redirect parameter and passes it into file-handling logic without enforcing an allowlist, canonicalization, or path restriction. This design flaw enables attackers to alter file selection behavior by crafting arbitrary values for the parameter.

Attack Vector

Exploitation is performed remotely over the network against the SMS PowerView web interface. An authenticated attacker with low privileges submits a manipulated redirect parameter within an HTTP request. The application processes the value and attempts to include or reference the specified file. The result may include disclosure of configuration files, source code, or inclusion of attacker-controlled content depending on the runtime environment.

No verified proof-of-concept code is published in the referenced advisories. Technical details are catalogued in the VulDB entry #302034 and the VulDB CTI Report #302034.

Detection Methods for CVE-2025-2982

Indicators of Compromise

HTTP requests to Legrand SMS PowerView endpoints containing suspicious redirect parameter values, particularly those referencing path traversal sequences such as ../ or absolute file paths.
Web server access logs showing repeated probing of the redirect parameter from a single source IP.
Unexpected file access patterns on the SMS PowerView host, especially reads of configuration, credential, or system files by the web application process.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the redirect parameter for path traversal characters, encoded traversal sequences, and non-allowlisted values.
Correlate authentication events with subsequent anomalous parameter usage to identify low-privilege accounts abusing the endpoint.
Baseline normal redirect parameter values in production traffic and alert on deviations.

Monitoring Recommendations

Enable verbose HTTP request logging on the SMS PowerView web server and forward logs to a centralized analytics platform.
Monitor file system access by the web application service account for reads outside of expected application directories.
Track outbound network connections from the SMS PowerView host that could indicate remote file inclusion attempts.

How to Mitigate CVE-2025-2982

Immediate Actions Required

Restrict network access to the Legrand SMS PowerView management interface using firewall rules or VPN-gated access.
Audit active user accounts and remove or disable low-privilege accounts that do not require SMS PowerView access.
Review historical web server logs for prior manipulation of the redirect parameter and investigate any suspicious activity.

Patch Information

No vendor patch is referenced in the available advisory data. The vendor did not respond to disclosure attempts prior to publication. Consult the VulDB advisory for updates and contact Legrand directly for remediation guidance.

Workarounds

Place the SMS PowerView web interface behind a reverse proxy that validates or strips the redirect parameter before it reaches the application.
Apply WAF signatures that block path traversal sequences and absolute file paths in query parameters.
Isolate the SMS PowerView host on a management VLAN with strict egress filtering to limit the impact of successful exploitation.

bash

# Example WAF rule concept blocking traversal patterns in the redirect parameter
# ModSecurity-style pseudocode
SecRule ARGS:redirect "@rx (\.\./|%2e%2e%2f|^/|file://)" \
    "id:1002982,phase:2,deny,status:403,msg:'CVE-2025-2982 redirect parameter traversal attempt'"