CVE-2024-40088

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-40088
A Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to enumerate the existence and length of any file in the filesystem by placing malicious payloads in the path of any HTTP request.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://vilo.com Not Applicable
https://github.com/byu-cybersecurity-research/vilo/blob/main/vulns/CVE-2024-40088.md Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:viloliving:vilo_5_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:viloliving:vilo_5:-:*:*:*:*:*:*:*
History

07 Jul 2025, 17:37

Type Values Removed Values Added
References () http://vilo.com - () http://vilo.com - Not Applicable
References () https://github.com/byu-cybersecurity-research/vilo/blob/main/vulns/CVE-2024-40088.md - () https://github.com/byu-cybersecurity-research/vilo/blob/main/vulns/CVE-2024-40088.md - Third Party Advisory
CPE cpe:2.3:o:viloliving:vilo_5_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:viloliving:vilo_5:-:*:*:*:*:*:*:*
First Time Viloliving
Viloliving vilo 5
Viloliving vilo 5 Firmware

23 Oct 2024, 15:12

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de recorrido de directorio en el servidor web Boa del sistema WiFi Mesh Vilo 5 &lt;= 5.16.1.33 permite a atacantes remotos no autenticados enumerar la existencia y la longitud de cualquier archivo en el sistema de archivos colocando cargas útiles maliciosas en la ruta de cualquier solicitud HTTP.

22 Oct 2024, 14:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CWE CWE-116
CWE-79

21 Oct 2024, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-21 21:15

Updated : 2025-07-07 17:37

NVD link : CVE-2024-40088

Mitre link : CVE-2024-40088

CVE.ORG link : CVE-2024-40088

JSON object : View

Products Affected

viloliving

  • vilo_5
  • vilo_5_firmware
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-116

Improper Encoding or Escaping of Output