CVE-2025-62630: Path Traversal in DeviceOn/iEdge

The impact of this vulnerability is significant. Successful exploitation allows an attacker to upload a malicious configuration file, effectively traversing the file system. This traversal can lead to the attacker gaining read and write access to sensitive files and directories, potentially including system configuration files, credentials, and proprietary data. The ability to execute code with system-level permissions grants the attacker complete control over the affected DeviceOn/iEdge instance, enabling them to install malware, steal data, or disrupt operations. The blast radius extends to any data or services reliant on the compromised DeviceOn/iEdge system.

1. Reserved2025-11-05
2. Published2025-11-06
3. Modified2025-11-07
4. EPSS updated2026-03-23

The primary mitigation is to upgrade DeviceOn/iEdge to version 2.0.3 or later, which includes the necessary fixes. If immediate upgrading is not possible, consider implementing temporary workarounds. These may include restricting file upload locations to a tightly controlled directory, implementing strict file type validation to prevent the upload of configuration files, and employing a Web Application Firewall (WAF) to filter out malicious requests attempting to exploit the path traversal vulnerability. Monitor system logs for unusual file access patterns or attempts to upload files with suspicious extensions. After upgrading, confirm the fix by attempting to upload a test configuration file with a path traversal payload (e.g., '../etc/passwd') and verifying that the upload fails with an appropriate error.