CVE-2023-38126: Softing edgeAggregator path traversal in backup restore leads to root RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRoot-level remote code execution with a high CVSS score and very high EPSS probability, though it requires authenticated high privileges and has no known in-the-wild exploitation.

What it is

Softing edgeAggregator fails to validate user-supplied paths when processing backup zip files during configuration restore, allowing directory traversal. An authenticated attacker can write files outside the intended location and execute code as root on the affected installation.

Impact

Successful exploitation gives the attacker arbitrary code execution in the context of root, meaning full control of the edgeAggregator host and any data or downstream connections it manages.

Attack surface

Reached remotely over the network via the configuration restore function that ingests backup zip files; the CVSS vector (AV:N/PR:H/UI:N) indicates network access with high privileges required and no user interaction.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged beyond the ZDI advisory, but EPSS is very high (0.71, 99th percentile), suggesting elevated likelihood of attempted exploitation.

What to do

• Apply the vendor patch or fixed edgeAggregator release referenced by Softing/ZDI as soon as it is available
• Restrict access to the configuration restore/backup upload function to trusted administrative networks and accounts
• Validate and sanitize archive entry paths before extraction, rejecting absolute paths and ../ sequences
• Run edgeAggregator with least privilege where possible and segment it from sensitive internal networks
• Monitor and audit administrative accounts that can invoke the restore function

Detection

• Alert on backup zip uploads or restore operations from unexpected source IPs or accounts
• Monitor for file writes outside expected restore directories, especially paths containing ../ or absolute paths
• Watch for new or modified executables and unexpected child processes spawned by the edgeAggregator service
• Review logs for restore activity followed by anomalous process creation or privilege escalation

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.