CVE-2024-58406

{
  "etk_id": "ETK-2026-4403",
  "cve_id": "CVE-2024-58406",
  "display_id": "CVE-2024-58406",
  "ghsa_id": null,
  "euvd_id": "EUVD-2024-55851",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated path traversal in Huatian Dynamic OA8000",
  "summary": "Huatian Dynamic OA8000 has a path traversal flaw in its download JSP endpoint. An unauthenticated remote attacker could retrieve files outside the intended directory, potentially disclosing configuration data or credentials. The endpoint must be reachable by the attacker.",
  "mitigation": "Block external access to /OAapp/jsp/trace/ntkodownload.jsp at a reverse proxy, firewall, or equivalent control until a vendor update is available. Restrict OA8000 access to trusted networks and authenticated users.",
  "vendor": "Dalian Huatian Software Co., Ltd.",
  "product": "Huatian Dynamic OA8000",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Huatian Dynamic OA8000",
      "purl": null
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 73.09599215,
  "t0_at": "2026-11-13T15:57:13.779000+00:00",
  "signals": {
    "kev": {
      "at": "2026-11-13T00:00:00+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T15:57:13.779000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2024-58406"
    },
    "public_poc": {
      "at": "2026-11-13T15:57:13.779000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T15:57:13.779000+00:00",
      "url": "https://cn-sec.com/archives/2540697.html"
    },
    "trigger_signal": {
      "at": "2026-11-13T15:57:13.779000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T15:57:13.779000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58406"
    }
  }
}