CVE-2009-1730: NetDecision TFTP Server directory traversal in GET and PUT commands

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable arbitrary file read and write with a CVSS 2.0 score of 10 and very high EPSS, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

NetDecision TFTP Server 4.2 contains multiple directory traversal flaws in its GET and PUT command handling, allowing traversal sequences to escape the intended TFTP root. Because TFTP is unauthenticated by design, any host that can reach the service can attempt to read or write files outside the served directory.

Impact

An attacker can read arbitrary files from the server and overwrite or create arbitrary files, which can lead to data disclosure, configuration tampering, or code execution depending on what is writable.

Attack surface

Reachable over the network via the TFTP service (UDP port 69 by default); no authentication or user interaction is required, as reflected in the AV:N/AC:L/Au:N vector.

Exploitation

No CISA KEV listing and no public exploit tag in the references, but EPSS is 0.5451 (99th percentile), indicating a high modeled likelihood of exploitation activity.

What to do

• Apply the vendor fix or upgrade NetDecision TFTP Server beyond 4.2 if an update is available; the record does not list a patched version.
• Restrict TFTP access to trusted management hosts with firewall or ACL rules, since the protocol has no authentication.
• Run the TFTP service with least privilege and point its root at a dedicated directory with no sensitive files.
• Disable the TFTP service entirely if it is not required.
• Monitor and alert on TFTP GET/PUT requests containing traversal sequences such as ../.

Detection

• Inspect TFTP request logs or packet captures for filenames containing ../ or encoded traversal sequences.
• Alert on TFTP PUT operations that create or modify files outside the configured root directory.
• Monitor file integrity in directories reachable from the TFTP root for unexpected changes.
• Baseline normal TFTP clients and flag requests from unfamiliar source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.