CVE-2015-2166 — AI Deep Analysis Summary

🚨 **What is this vulnerability?** * **Type:** Directory Traversal in Ericsson Drutt MSDP Instance Monitor. * **Mechanism:** Attackers use `..%2f` (encoded slash) in the default URI. * **Consequence:** Remote attac…

🛡️ **Root Cause? (CWE/Flaw)** * **Flaw:** Improper input validation in the Instance Monitor. * **CWE:** Not specified in data (typically CWE-22: Improper Limitation of a Pathname to a Restricted Directory).…

👥 **Who is affected? (Versions/Components)** * **Product:** Ericsson Drutt Mobile Service Delivery Platform (MSDP). * **Component:** Instance Monitor. * **Affected Versions:** * Version 4 📦 * Version 5…

🕵️ **What can hackers do? (Privileges/Data)** * **Action:** Read arbitrary files from the server.…

🔑 **Is exploitation threshold high? (Auth/Config)** * **Threshold:** **LOW** 📉 * **Auth:** No authentication mentioned. It exploits the "default URI". * **Complexity:** Simple string injection (`..%2f`).…

💣 **Is there a public Exp? (PoC/Wild Exploitation)** * **Yes!** Public exploits exist.…

🔍 **How to self-check? (Features/Scanning)** * **Manual Test:** Send a request with `..%2f` in the URI to the Instance Monitor endpoint. * **Automated Scan:** Use Nuclei templates (`http/cves/2015/CVE-2015-2166.yaml…

🩹 **Is it fixed officially? (Patch/Mitigation)** * **Status:** Published in 2015. ⏳ * **Fix:** Ericsson likely released patches for versions 4, 5, and 6.…

🚧 **What if no patch? (Workaround)** * **Network:** Block external access to the Instance Monitor port. 🚫 * **WAF:** Configure Web Application Firewall to block `..%2f` patterns in URIs.…

⚡ **Is it urgent? (Priority Suggestion)** * **Priority:** **HIGH** for legacy systems. 🚨 * **Reason:** Public exploits exist, and it allows file read without auth.…