Path Traversal in Digitek from Grupo Azkoyen
- Digitek ADT1100;
- Digitek DT950.
INCIBE has coordinated the publication of a high-severity vulnerability affecting Digitek by PRIMION DIGITEK, S.L.U (Azkoyen Group), advanced terminals designed for security and human resources management. The vulnerability was discovered by Óscar Atienza Vendrell.
This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector, and CWE vulnerability type:
- CVE-2026-1523: CVSS v4.0: 8.7 | CVSS AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | CWE-22
The vulnerability has been fixed in the latest version of the affected products.
CVE-2026-1523: Path Traversal vulnerability in Digitek ADT1100 and Digitek DT950 from PRIMION DIGITEK, S.L.U (Azkoyen Group). This vulnerability allows an attacker to access arbitrary files in the server's file system, thet is, 'http://<host>/..%2F..% 2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd'. By manipulating the input to include URL encoded directory traversal sequences (e.g., %2F representing /), an attacker can bypass the input validation mechanisms ans retrieve sensitive files outside the intended directory, which could lead to information disclosure or further system compromise.
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-1523 | Alta | No | Grupo Azkoyen |
