CVE-2018-7539

On Appear TV XC5000 and XC5100 devices with firmware 3.26.217, it is possible to read OS files with a specially crafted HTTP request (such as GET /../../../../../../../../../../../../etc/passwd) to the web server (fuzzd/0.1.1) running the Maintenance Center on port TCP/8088. This can lead to full compromise of the device.

• CWE-22

• http://seclists.org/fulldisclosure/2018/Apr/34Exploit, Mailing List, Mitigation, Third Party Advisory
• http://seclists.org/fulldisclosure/2018/Apr/34Exploit, Mailing List, Mitigation, Third Party Advisory

Published

Apr 17, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7533An Incorrect Default Permissions issue was discovered in OSI…
• CVE-2018-7534In Stealth Authorization Server before 3.3.017.0 in Unisys S…
• CVE-2018-7535An issue was discovered in TotalAV v4.1.7. An unprivileged u…
• CVE-2018-7536An issue was discovered in Django 2.0 before 2.0.3, 1.11 bef…
• CVE-2018-7537An issue was discovered in Django 2.0 before 2.0.3, 1.11 bef…
• CVE-2018-7538A SQL injection vulnerability in the tracker functionality o…
• CVE-2018-7540An issue was discovered in Xen through 4.10.x allowing x86 P…
• CVE-2018-7541An issue was discovered in Xen through 4.10.x allowing guest…
• CVE-2018-7542An issue was discovered in Xen 4.8.x through 4.10.x allowing…
• CVE-2018-7543Cross-site scripting (XSS) vulnerability in installer/build/…6.1
• CVE-2018-7544A cross-protocol scripting issue was discovered in the manag…
• CVE-2018-7546wpsmain.dll in Kingsoft WPS Office 2016 and Jinshan PDF 10.1…