How severe is CVE-2025-27395?

This vulnerability has a severity rating of HIGH with a CVSS score of 7.2 out of 10.

What type of vulnerability is CVE-2025-27395?

This is classified as CWE-22, which is a common weakness in software security.

CVE-2025-27395 - HIGH Severity | CVSS 7.2

Vulnerability Description

A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly limit the scope of files accessible through and the privileges of the SFTP functionality. This could allow an authenticated highly-privileged remote attacker to read and write arbitrary files.

Related Vulnerabilities

CVE-2016-0709

HIGH

CVSS:7.2(High)

Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and c...

CWE-222016

CVE-2016-10751

HIGH

CVSS:7.2(High)

osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP...

CWE-222016

CVE-2016-1593

HIGH

CVSS:7.2(High)

Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators to upload and execute arbitrary JSP files via a ....

CWE-222016

CVE-2017-16744

HIGH

CVSS:7.2(High)

A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Microsoft Windows Systems can be exploited by leveraging valid pla...

CWE-222017

CVE-2017-16788

HIGH

CVSS:7.2(High)

Directory traversal vulnerability in the "Upload Groupkey" functionality in the Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users wi...

CWE-222017

CVE-2017-3980

HIGH

CVSS:7.2(High)

A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, and 5.1.3 and earlier allows remote authenticated users to execute a command of their choice...

CWE-222017