CVE-2012-4031: Wangkongbao CNS-1000/1100 directory traversal in acloglogin.php

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityUnauthenticated remote file read with public exploit code and very high EPSS, though not in KEV and rated only MEDIUM by CVSS 2.0.

What it is

src/acloglogin.php in Wangkongbao CNS-1000 and CNS-1100 fails to sanitize the lang and langid cookies, allowing directory traversal. An attacker can read arbitrary files on the device through crafted cookie values. The flaw exposes configuration and credential material on an internet-reachable appliance.

Impact

An unauthenticated attacker gains read access to arbitrary files on the device, which can leak credentials, configuration and other sensitive data. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network against port 85 of the appliance; no authentication or user interaction is required per the CVSS vector AV:N/AC:L/Au:N. The attack is delivered through the lang or langid cookie.

Exploitation

Public exploit code exists (Exploit-DB and SecurityFocus references tagged Exploit), and EPSS is high at roughly 0.52 (99th percentile), but the CVE is not listed in CISA KEV.

What to do

• Apply the vendor fix or firmware update for CNS-1000/CNS-1100; if none is available, isolate the device.
• Restrict access to port 85 to trusted management networks and block it from the internet.
• Filter or reject cookie values containing path traversal sequences such as '..' at a reverse proxy or WAF.
• Replace end-of-life appliances that no longer receive security updates.

Detection

• Inspect web logs for requests to acloglogin.php with lang or langid cookies containing '..' or encoded traversal sequences.
• Alert on HTTP requests to port 85 from untrusted sources or unexpected geographies.
• Monitor for file-read patterns or unusual outbound traffic from the appliance that could indicate data exfiltration.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.