CVE-2025-34098

published 2025-07-10

CVE-2025-34098: A path traversal vulnerability exists in Riverbed SteelHead VCX appliances (confirmed in VCX255U 9.6.0a) due to improper input validation in the log filtering…

Priority P3 48 high 7.1 CVSS 4.0

AV N AC L AT N PR L UI N VC H VI N VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

A path traversal vulnerability exists in Riverbed SteelHead VCX appliances (confirmed in VCX255U 9.6.0a) due to improper input validation in the log filtering functionality exposed via the management web interface. An authenticated attacker can exploit this flaw by submitting crafted filter expressions to the log_filter endpoint using the filterStr parameter. This input is processed by a backend parser that permits execution of file expansion syntax, allowing the attacker to retrieve arbitrary system files via the log viewing interface.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
riverbed_technology	steelhead_vcx	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /log_filter↗

other filterStr=<crafted path traversal filter expression>↗

• → Monitor HTTP requests to the management web interface targeting the log_filter endpoint with anomalous or crafted filterStr parameter values, particularly those containing path traversal sequences or file expansion syntax (e.g., glob patterns, `..`, `/etc/`, `/proc/`). ↗
• → A Metasploit auxiliary scanner module exists for this vulnerability (riverbed_steelhead_vcx_file_read.rb); look for scanner/http/riverbed_steelhead_vcx_file_read in exploit framework logs or network traffic patterns consistent with automated file read enumeration against Riverbed SteelHead VCX management interfaces. ↗
• → Scope detection to Riverbed SteelHead VCX255U appliances running version 9.6.0a, as this is the confirmed vulnerable version; prioritize alerting on authenticated sessions making unusual log filter requests on the management interface. ↗

• · Exploitation requires prior authentication to the management web interface; unauthenticated access alone is insufficient to trigger this vulnerability. ↗
• · Confirmed vulnerable only on VCX255U running firmware version 9.6.0a; applicability to other VCX models or firmware versions has not been confirmed in available sources. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200