Rapid7 has reported a vulnerability in SolarWinds TFTP Server, which can be exploited by malicious people to disclose potentially sensitive information.

The vulnerability is caused due an input validation error and makes it possible to download files from arbitrary locations outside the TFTP root via specially crafted directory traversal sequences.

Example:
get NUL/....//....//[file]

The vulnerability has been reported in version 8.1. Prior versions may also be affected.

Solution
Update to version 8.2 or later.

Provided and/or discovered by
Rapid7

Original Advisory
http://www.rapid7.com/advisories/R7-0019.html

Deep Links
Links available in Customer Area