CVE-2017-16786

The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users with certain privileges to read arbitrary files via (1) the ntpclientcounterlogfile parameter to cgi-bin/mainv2 or (2) vectors involving curl support of the "file" schema in the firmware update functionality.

• CWE-200

• http://packetstormsecurity.com/files/145388/Meinberg-LANTIME-Web-Configuration-Utility-6.16.008-Arbitrary-File-Read.htmlIssue Tracking, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2017/Dec/50Issue Tracking, Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/145388/Meinberg-LANTIME-Web-Configuration-Utility-6.16.008-Arbitrary-File-Read.htmlIssue Tracking, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2017/Dec/50Issue Tracking, Mailing List, Third Party Advisory

Published

Dec 19, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16780The installer in MyBB before 1.8.13 allows remote attackers …
• CVE-2017-16781The installer in MyBB before 1.8.13 has XSS.
• CVE-2017-16782In Home Assistant before 0.57, it is possible to inject Java…
• CVE-2017-16783In CMS Made Simple 2.1.6, there is Server-Side Template Inje…9.8
• CVE-2017-16784In CMS Made Simple 2.2.2, there is Reflected XSS via the cnt…
• CVE-2017-16785Cacti 1.1.27 has reflected XSS via the PATH_INFO to host.php…
• CVE-2017-16787The Web Configuration Utility in Meinberg LANTIME devices wi…
• CVE-2017-16788Directory traversal vulnerability in the "Upload Groupkey" f…
• CVE-2017-16789Cross-site scripting (XSS) vulnerability in Integration Matt…
• CVE-2017-1679IBM OpenPages GRC Platform 7.2, 7.3, 7.4, and 8.0 could allo…5.5
• CVE-2017-16790An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.…
• CVE-2017-16792Stored cross-site scripting (XSS) vulnerability in "geminabo…6.1