Medium severity · published Aug 1, 2025
CVE-2013-10063
Netgear SPH200D <= 1.0.4.80 Path Traversal via HTTP GET
6.9
CVSS
1.4%
EPSS
No
On KEV
Description
A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions <= 1.0.4.80 in its embedded web server. Authenticated attackers can exploit crafted GET requests to access arbitrary files outside the web root by injecting traversal sequences. This can expose sensitive system files and configuration data.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
SPH200D · Netgear
through 1.0.4.80 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-10063
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-10063
raw.githubusercontent.com
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/netgear_sph200d_traversal.rb
web.archive.org
https://web.archive.org/web/20130207034706/http://www.s3cur1ty.de/m1adv2013-002
www.exploit-db.com
https://www.exploit-db.com/exploits/24441
www.vulncheck.com
https://www.vulncheck.com/advisories/netgear-sph200d-path-traversal-via-http-get