Vulnerability record · CVE-2017-11165 · published 12 July 2017
CVE-2017-11165: DataTaker DT80 dEX firmware exposes credentials and configuration via unauthenticated file request
Thermofisher · Dt80 Dex Firmware
The dataTaker DT80 dEX 1.50.012 web service allows a direct, unauthenticated request to /services/getFile.cmd?userfile=config.xml, which returns the device configuration file. That file contains sensitive credential and configuration data, so anyone who can reach the interface can read it.
Description
dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated network access to a file containing credentials and configuration, with a CVSS score of 9.8 and high EPSS probability, makes this a critical exposure.
What it is
The dataTaker DT80 dEX 1.50.012 web service allows a direct, unauthenticated request to /services/getFile.cmd?userfile=config.xml, which returns the device configuration file. That file contains sensitive credential and configuration data, so anyone who can reach the interface can read it.
Impact
An attacker obtains stored credentials and device configuration, enabling further access to the device or connected systems. The CVSS vector rates confidentiality, integrity and availability impact as high, though the described flaw is an information exposure.
Attack surface
Reachable over the network through the device's web service with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N and the direct-request description.
Exploitation
Public exploit references exist (Packet Storm and Exploit-DB), and EPSS is 0.6413 (99.2nd percentile), indicating high predicted exploitation activity; the CVE is not listed in CISA KEV.
What to do
- Apply the vendor's fixed firmware for the DT80 dEX if available; the record does not state a patched version.
- Restrict network access to the device web service to trusted management hosts only.
- Disable or block the /services/getFile.cmd endpoint if it is not required.
- Change any credentials that may have been exposed in config.xml.
- Monitor the device for unauthorized configuration reads and unexpected access.
Detection
- Alert on HTTP requests to /services/getFile.cmd with userfile=config.xml.
- Log and review access to the device web service from untrusted source addresses.
- Hunt for repeated or automated requests to getFile.cmd across the environment.
- Check device logs for configuration file retrieval outside normal maintenance windows.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://packetstormsecurity.com/files/143328/DataTaker-DT80-dEX-1.50.012-Sensitive-Configuration-Exposure.html | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/42313/ | Third Party AdvisoryVDB Entry |
| https://packetstormsecurity.com/files/143328/DataTaker-DT80-dEX-1.50.012-Sensitive-Configuration-Exposure.html | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/42313/ | Third Party AdvisoryVDB Entry |
Track CVE-2017-11165 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-11165), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
