CVE-2025-47423: Weather Station Dashboard Path Traversal

CVE-2025-47423 Overview

CVE-2025-47423 is a path traversal vulnerability affecting Personal Weather Station (PWS) Dashboard version 12_lts. Unauthenticated remote attackers can exploit the test parameter in /others/_test.php to read arbitrary files on the server. The PoC demonstrates reading the server's private SSL key in cleartext, exposing cryptographic material used to secure HTTPS communications. The flaw is classified under [CWE-24: Path Traversal: '../filedir'] and requires no authentication or user interaction to exploit.

Critical Impact
Unauthenticated attackers can retrieve sensitive server files, including private SSL keys, credentials, and configuration files, using ../ sequences in the vulnerable parameter.

Affected Products

Personal Weather Station Dashboard 12_lts
Deployments exposing /others/_test.php to the network
PWS Dashboard installations without upstream input filtering

Discovery Timeline

2025-05-07 - CVE-2025-47423 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47423

Vulnerability Analysis

The vulnerability resides in the /others/_test.php endpoint of PWS Dashboard 12_lts. The test parameter is passed to a file read operation without sanitization or canonicalization. Attackers supply ../ sequences to escape the intended directory and access files elsewhere on the filesystem. The endpoint returns the file contents in the HTTP response, giving the attacker direct read access.

The issue is network-reachable and requires no credentials. The scope is changed because file disclosure can affect resources beyond the vulnerable component, including the web server's private key material. Confidentiality is impacted, while integrity and availability are not directly affected by the read primitive itself.

Root Cause

The root cause is missing input validation on user-controlled path input. The _test.php script concatenates the test parameter into a file path without stripping directory traversal sequences or enforcing a whitelist of allowed files. This maps to [CWE-24], a specific form of path traversal using relative parent directory references.

Attack Vector

An attacker sends an HTTP GET request to /others/_test.php with the test parameter set to a traversal payload such as ../../../../etc/ssl/private/server.key. The PoC published on GitHub demonstrates retrieval of the private SSL key in cleartext. Once the key is disclosed, an attacker can decrypt captured TLS traffic or impersonate the server. Additional targets include /etc/passwd, application configuration files, database credentials, and API tokens.

Refer to the GitHub PoC Repository for technical details of the request format.

Detection Methods for CVE-2025-47423

Indicators of Compromise

HTTP requests to /others/_test.php containing ../ or URL-encoded variants (%2e%2e%2f, %2e%2e/) in the test parameter
Web server access logs showing requests to _test.php from unexpected external IP addresses
Outbound transfers of files matching sensitive path patterns such as .key, .pem, .conf, or /etc/passwd
Successful 200 responses to _test.php requests containing traversal sequences

Detection Strategies

Deploy web server or WAF rules that flag path traversal patterns in query strings targeting PHP endpoints
Correlate access log entries for _test.php with response sizes larger than expected for a test script
Alert on any request to /others/_test.php from non-administrative source addresses

Monitoring Recommendations

Enable verbose HTTP request logging on the web server hosting PWS Dashboard
Monitor file access telemetry for reads of SSL private keys, /etc/passwd, and application secrets by the web server process
Track EPSS trend data; the current EPSS score of 2.114% (79.67th percentile) indicates meaningful exploitation likelihood

How to Mitigate CVE-2025-47423

Immediate Actions Required

Restrict network access to the PWS Dashboard interface using firewall rules or reverse proxy allowlists
Remove or rename /others/_test.php if the file is not required for production operation
Rotate SSL/TLS private keys and any credentials stored on the affected host, assuming compromise until logs prove otherwise
Review web server access logs for prior exploitation attempts against _test.php

Patch Information

No official vendor patch is referenced in the NVD entry at the time of publication. Consult the PWS Dashboard Home for updated releases and advisories. Until a fixed version is available, operators should apply the workarounds below.

Workarounds

Block requests containing ../, ..\, or URL-encoded traversal sequences at a reverse proxy or WAF placed in front of the dashboard
Configure the web server to deny direct access to /others/_test.php using location-based rules
Run the PHP process under a low-privilege account whose filesystem access is restricted via open_basedir or equivalent controls
Move sensitive files such as SSL private keys outside any directory reachable via relative traversal from the web root

bash

# Example nginx rule to block traversal on the vulnerable endpoint
location = /others/_test.php {
    if ($args ~* "\.\./|%2e%2e|%2E%2E") {
        return 403;
    }
    deny all;
}

# Example PHP hardening in php.ini
open_basedir = /var/www/pwsdashboard/:/tmp/