CVE-2013-10063

published 2025-08-01

CVE-2013-10063: A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions <= 1.0.4.80 in its embedded web server. Authenticated attackers can…

Priority P3 47 medium 6.9 CVSS 4.0

AV N AC L AT N PR H UI N VC H VI N VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions <= 1.0.4.80 in its embedded web server. Authenticated attackers can exploit crafted GET requests to access arbitrary files outside the web root by injecting traversal sequences. This can expose sensitive system files and configuration data.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
netgear	sph200d	<= 1.0.4.80	—

Detection & IOCs extracted from sources · hover to see the quote

url /../../etc/passwd↗

path ../../etc/passwd↗

• → Look for HTTP GET requests containing directory traversal sequences (e.g., '../') targeting the Netgear SPH200D embedded web server ↗
• → A Metasploit auxiliary scanner module exists for this vulnerability and may be used in active exploitation attempts: modules/auxiliary/scanner/http/netgear_sph200d_traversal.rb ↗

• · Exploitation requires prior authentication to the device's embedded web server ↗
• · Vulnerability is confirmed only in Netgear SPH200D firmware versions 1.0.4.80 and below ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22