Cyber Resilience

CVE-2025-67160

HighPublic PoC

Published: 02 January 2026

Published
02 January 2026
Modified
30 January 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0018 39.8th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-67160 is a high-severity Path Traversal (CWE-22) vulnerability in Vatilon Pa4 Firmware. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-67160 is a directory traversal vulnerability (CWE-22) in Vatilon version 1.12.37-20240124. Published on 2026-01-02, it enables attackers to access sensitive directories and files. The issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity due to its potential for significant confidentiality impact.

Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation allows reading of sensitive files and directories, compromising confidentiality without impacting integrity or availability.

Mitigation details and additional information are available in advisories referenced at http://vatilon.com and https://github.com/Remenis/CVE-2025-67160.

EU & UK References

Vulnerability details

An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal.

CWE(s)
CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
attack.mitre.org →
Why these techniques?

Directory traversal directly enables remote exploitation of a public-facing app (T1190) and unauthorized reading of local files/directories (T1005, T1083).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-67159Same product: Vatilon Pa4
CVE-2025-60946Shared CWE-22
CVE-2026-6024Shared CWE-22
CVE-2026-49128Shared CWE-22
CVE-2026-30914Shared CWE-22
CVE-2026-22557Shared CWE-22
CVE-2021-47850Shared CWE-22
CVE-2019-25579Shared CWE-22
CVE-2025-52452Shared CWE-22
CVE-2025-2264Shared CWE-22

Affected Assets

vatilon
pa4 firmware
1.12.37-20240124

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Requires identification, reporting, and correction of the specific directory traversal flaw in Vatilon v1.12.37-20240124, preventing unauthorized access to sensitive files.

SI-10 Information Input Validation good match
prevent

Mandates validation of inputs like file paths to block directory traversal sequences such as '../', directly addressing the CWE-22 exploitation in this CVE.

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations for access to sensitive directories and files, blocking reads even if attackers bypass intended paths via traversal.

References