CyberRota Analysis
AI-GeneratedAn improper access restriction vulnerability in the AppEngine Fileaccess feature allows unauthenticated attackers to read and write sensitive files, including device parameter files and application settings, potentially compromising customer-defined passwords. This critical exposure could also enable the execution of arbitrary Lua code within the AppEngine environment. Organizations using AppEngine should prioritize immediate remediation to protect sensitive data and maintain application integrity.
Original NVD Description
An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.