CVE-2026-1523: Digitek ADT1100/DT950 Path Traversal Flaw

CVE-2026-1523 Overview

A Path Traversal vulnerability has been identified in Digitek ADT1100 and Digitek DT950 devices manufactured by PRIMION DIGITEK, S.L.U (Azkoyen Group). This vulnerability allows unauthenticated attackers to access arbitrary files on the server's file system by manipulating URL-encoded directory traversal sequences. By bypassing input validation mechanisms, attackers can retrieve sensitive files outside the intended directory, potentially leading to information disclosure or further system compromise.

Critical Impact

Unauthenticated attackers can remotely access sensitive system files such as /etc/passwd through URL-encoded path traversal sequences, enabling information disclosure and potential system compromise.

Affected Products

• Digitek ADT1100
• Digitek DT950
• PRIMION DIGITEK, S.L.U (Azkoyen Group) devices

Discovery Timeline

• 2026-02-05 - CVE CVE-2026-1523 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-1523

Vulnerability Analysis

This Path Traversal vulnerability (CWE-22) exists due to improper input validation in the web interface of Digitek ADT1100 and DT950 devices. The vulnerability allows remote attackers to traverse the file system directory structure without requiring authentication. The flaw stems from the application's failure to properly sanitize URL-encoded characters in HTTP requests.

When processing HTTP requests, the application fails to decode and validate URL-encoded directory traversal sequences before using them in file system operations. This allows attackers to craft malicious requests containing sequences like %2F (representing /) and ..%2F (representing ../) to navigate outside the intended web root directory.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization of user-supplied input in HTTP request paths. The application does not properly decode URL-encoded characters before checking for directory traversal patterns, allowing attackers to bypass security controls by encoding the path separators and parent directory references.

Specifically, the web server fails to:

1. Canonicalize the requested path before validation
2. Decode URL-encoded characters before checking for traversal sequences
3. Restrict file access to the intended document root directory

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending a specially crafted HTTP GET request to the vulnerable device containing URL-encoded directory traversal sequences.

The attack follows this pattern:

1. The attacker identifies a vulnerable Digitek ADT1100 or DT950 device accessible over the network
2. The attacker crafts an HTTP request with URL-encoded traversal sequences (e.g., ..%2F to represent ../)
3. The request bypasses input validation because the traversal characters are encoded
4. The server processes the request and returns the contents of the requested file from outside the web root

For example, an attacker could request: http://<host>/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd to retrieve the system password file. For detailed technical information, refer to the INCIBE Security Advisory.

Detection Methods for CVE-2026-1523

Indicators of Compromise

• HTTP access logs showing requests with URL-encoded traversal sequences such as ..%2F, %2e%2e%2f, or %252e%252e%252f
• Multiple requests attempting to access system files like /etc/passwd, /etc/shadow, or Windows system files
• Unusual outbound data transfers from web server processes
• Web server error logs indicating attempts to access files outside the document root

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block URL-encoded directory traversal patterns
• Configure intrusion detection systems (IDS) to alert on HTTP requests containing traversal sequences in any encoding format
• Enable detailed HTTP access logging and monitor for suspicious path patterns
• Deploy network traffic analysis to identify attempts to exfiltrate sensitive file contents

Monitoring Recommendations

• Regularly review web server access logs for anomalous file access patterns
• Set up alerts for requests containing encoded characters followed by sensitive file paths
• Monitor network egress for unexpected data exfiltration from affected devices
• Implement file integrity monitoring on critical system files to detect unauthorized access attempts

How to Mitigate CVE-2026-1523

Immediate Actions Required

• Restrict network access to affected Digitek ADT1100 and DT950 devices using firewall rules
• Place vulnerable devices behind a reverse proxy with strict URL filtering capabilities
• Implement network segmentation to isolate affected devices from sensitive network segments
• Monitor device logs for signs of exploitation attempts

Patch Information

Organizations should consult the vendor PRIMION DIGITEK, S.L.U for official patch availability and update instructions. Refer to the INCIBE Security Advisory for the latest remediation guidance.

Workarounds

• Deploy a web application firewall (WAF) configured to block URL-encoded directory traversal attempts
• Restrict HTTP access to affected devices to trusted IP addresses only
• Disable direct internet access to vulnerable devices until patches are available
• Use a reverse proxy with strict path normalization and validation rules

# Example: Block direct access to vulnerable devices using iptables
# Allow only specific trusted management IPs
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP