CVE-2022-4982CWE-22CWE-98

DBLTek GoIP-1 vGHSFVT-1.1-67-5 Unauthenticated LFI

High · published November 12, 2025

CVSS v4.0
8.7
EPSS
1%
Percentile
44.1
In the wild
Unconfirmed
What it is

DBLTek GoIP-1 firmware versions up to and including GHSFVT-1.1-67-5 contain a local file inclusion vulnerability. The device's web server exposes handlers (`frame.html` and `frame.A100.html`) that accept a path parameter (`content` or `sidebar`) which is not properly validated or canonicalized. An attacker can supply directory-traversal sequences to cause the server to read and return arbitrary filesystem files that the webserver user can access. Other GoIP models and firmware versions are likely affected. Exploitation evidence was observed by the Shadowserver Foundation on 2024-03-21 UTC.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00531 · 44.1th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-98 · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Published
2025-11-12T22:10Z
EPSS history
Timeline
  • 12 NOV 22:10Z
    DBLTek GoIP-1 vGHSFVT-1.1-67-5 Unauthenticated LFI
    cvelistv5