CVE-2021-45043: HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter.

PriorityP266high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EXPLOIT

EPSS

33.13%

98.2th percentile

HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
hd-network_real-time_monitoring_system_project	hd-network_real-time_monitoring_system	—	—

Detection & IOCsextracted from sources · hover to see the quote

urlGET /language/lang HTTP/1.1↗

cookies_Language=../../../../../../../../../../../../../../etc/passwd↗

path/language/lang↗

→Exploit targets the `s_Language` cookie parameter with directory traversal sequences (../../) to read sensitive files such as /etc/passwd or /etc/shadow. Monitor HTTP requests to /language/lang with cookie values containing '../' sequences. ↗
→Successful exploitation returns HTTP 200 with content matching 'root:.*:0:0:' in the response body, indicating /etc/passwd file disclosure. ↗
→Identify exposed instances via Shodan or Google using the title fingerprint 'HD-Network Real-time Monitoring System V2.0'. ↗
→The vulnerability is exploitable by unauthenticated remote attackers — no session or credentials are required. Any request to /language/lang with a traversal payload in the s_Language cookie should be treated as an active exploitation attempt. ↗

·The traversal payload depth in the s_Language cookie uses an excessive number of '../' sequences (15+), suggesting the application does not normalize or limit path traversal depth. Detection rules should match on any occurrence of '../' in the s_Language cookie, not just the exact depth shown in the PoC. ↗
·The NVD description references /etc/shadow as the target file, while the PoC uses /etc/passwd. Both sensitive files are reachable; detection and alerting should cover both targets. ↗

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.