s::can moni::tools prone to path traversal in image-relocator module
Priority MEDIUM 41CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
In s::can moni::tools in versions below 4.2 an unauthenticated attacker could get any file from the device by path traversal in the image-relocator module.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00962 61st percentileScored 2026-11-07
Fix Fixed moni::tools (s::can): 4.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Badger Meter | moni::tools | 1.0 to before 4.2 | 4.2 | Patch available | CNA |
- moni::tools VendorBadger Meter Affected 1.0 to before 4.2 Fixed in 4.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:badgermeter:moni\:\:tool:*:*:*:*:*:*:*:* | tool | Vulnerable | Badger Meter |
- cpe:2.3:a:badgermeter:moni\:\:tool:*:*:*:*:*:*:*:* Versions tool Vulnerable ·Badger Meter
Remediation
- Fix · CNA moni::tools (s::can) Fixed in 4.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
s::can moni::tools 4.2
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2020-10004 s::can moni::tools prone to path traversal in camera-file modulePriority MEDIUM 41
Timeline
- 2026-10-02 Threatist record created from CVE-2020-12508
- 2026-10-03 Alias added: GHSA-h9m7-7fr7-xhf5
References
More Badger Meter Moni vulnerabilities
- TI-2020-10002 s::can moni::tools autheticated SQL injection CVSS 3.1HIGH 8.8
- TI-2020-10004 s::can moni::tools prone to path traversal in camera-file module CVSS 3.1HIGH 7.5
Sources
- CVE-2020-12508 · CVE Program
- CVE-2020-12508 · NVD
- FIRST EPSS
- GHSA-h9m7-7fr7-xhf5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences