Home/CVE/A path traversal vulnerability exists in A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier. The vul
CVE
↯ PDF report

CVE-2014-1251254

A path traversal vulnerability exists in A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier. The vul

A path traversal vulnerability exists in A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier. The vulnerability resides in the handling of the filename parameter in the /xml/downloads endpoint, which fails to properly sanitize user input. An unauthenticated attacker can exploit this flaw by sending crafted HTTP requests containing directory traversal sequences to read arbitrary files outside the intended directory.

The files returned by the vulnerable endpoint are deleted from the system after retrieval. This can lead to unauthorized disclosure of sensitive information such as SSL certificates and private keys, as well as unintended file deletion.

EPSS 0.01932
EPSS exploitation odds1.93% · top 22%
Schedule remediation
  • Public exploit or PoC is available
  • SSVC automatable: yes - attacks can be scripted at scale
  • ⚠ NVD has not scored this CVE yet - manual triage required (common for recent CVEs)
No Sigma yet — build one → YARA rules0
Look this up elsewhere - one-click external pivots
NVDCVE.orgCISAExploit-DBGitHub PoCVulnCheck KEVGreyNoise
▸ How to read a CVE - triage first, then detect and patch
This page is every public fact about CVE-2014-125125, cross-linked. Its job is to answer one question fast - does this need my attention now? - and then hand you the two things you do about it. Here is how an analyst reads it.
Triage: should I act now? Four signals, and they are not interchangeable:
CVSSseverity - how bad it is IF exploited, 0-10. A high CVSS alone is not urgency; a flaw can be a perfect 10 and never actually be attacked. EPSSprobability - a model’s estimate of the chance it is exploited in the next 30 days, 0-1. This is the “will it actually happen” signal. CISA KEVconfirmed - it is being exploited in the wild right now. The strongest signal on the page; KEV beats any score. Weaponisedavailability - public exploits / PoCs, and especially Metasploit modules rated Excellent / Great. Reliable, packaged exploit code means low-skill attackers can use it today.
How they combine: KEV, or a dependable Metasploit module, means patch now regardless of CVSS. High CVSS + low EPSS + no exploit is real but not an emergency - schedule it. Low CVSS but KEV-listed still gets patched now. The verdict above already weighed these for you; this is how it got there.
Then what - two workflows:
Detectwhen you cannot patch today, follow this CVE to the ATT&CK techniques it enables, then Build a SIEM detection (the green button) - author a rule, test it in Atomic, deploy it. That buys visibility while the patch waits. PatchAffected products / packages tell you if you are exposed; Fixed versions by distribution and Vendor advisories give the exact version that closes it.
Reading order for the panels below: verdict + badges, then Public exploits / Metasploit (is it weaponised), then ATT&CK techniques + Sigma / IDS rules (can I detect it), then Affected products / packages + Fixed versions (am I exposed, what patches it), then Threat actors / IOCs (who uses it), then Scoring & timeline / references (the evidence).
▣

Severity & exploitation scoring

EPSS exploitation probability
1.93%
Top 22%odds of exploitation in the next 30 days
CVSS metric silhouette
No structured CVSS vector for this CVE. Older entries often have only a numeric base score - the metric breakdown radar requires a full AV:_/AC:_/... vector string published by NVD.
SSVC triage · cisa-vulnrichment
Exploitation
poc
Automatable
yes
Tech impact
partial
Lifecycle
  1. 31 Jul 2025Published to NVD
  2. 17 Jun 2026Last modified
Every entry is a recorded date - NVD publish/modify, CISA KEV add, public exploit disclosure. No inferred events.
Attack path
Full kill chain
→
⚠

Public Exploits & PoCs

4
These PoC and exploit links come from public sources and are not verified to be safe or functional. Review the code before running anything, and treat unverified entries as untrusted. Signed-in users mark whether it works, rate 1-10, and can report malware with a required reason that becomes a public comment.
poc ARPSyndicate/cve-scores (trickest)↗ date unknown
⋮
Vote & rate
Report or claim
⚠ Report this PoC

Becomes a public comment attributed as First L. (never full last name). Don't include private info. Rate-limited: 5/hour.

Works? no reports yet
Rating -
poc fkie-cad/nvd-json-data-feeds (trickest)↗ date unknown
⋮
Vote & rate
Report or claim
⚠ Report this PoC

Becomes a public comment attributed as First L. (never full last name). Don't include private info. Rate-limited: 5/hour.

Works? no reports yet
Rating -
poc raw.githubusercontent.com · a10networks_ax_directory_traversal.rb↗ raw.githubusercontent.com
⋮
Vote & rate
Report or claim
⚠ Report this PoC

Becomes a public comment attributed as First L. (never full last name). Don't include private info. Rate-limited: 5/hour.

Works? no reports yet
Rating -
poc www.exploit-db.com · 31261↗ www.exploit-db.com
⋮
Vote & rate
Report or claim
⚠ Report this PoC

Becomes a public comment attributed as First L. (never full last name). Don't include private info. Rate-limited: 5/hour.

Works? no reports yet
Rating -
◆

ATT&CK techniques

1

Techniques this CVE enables. Pills with a solid outline are high confidence - named directly in ATT&CK or Nuclei, or human-curated by CTID; the rest are inferred from the weakness type using MITRE's CVE Mapping Methodology and the CWE → CAPEC chain. Broad, generic-weakness guesses are filtered out. A small N× marks a technique that N independent sources agree on.

T1005 · Data from Local System
▤ Build a SIEM detection for these techniques
▤

CAPEC attack patterns

9

Attack patterns this CVE enables - the bridge from weakness to ATT&CK technique.

CAPEC-CAPEC-126 · Path Traversal CAPEC-CAPEC-159 · Redirect Access to Libraries CAPEC-CAPEC-177 · Create files with the same name as files protected with a higher classification CAPEC-CAPEC-48 · Passing Local Filenames to Functions That Expect a URL CAPEC-CAPEC-64 · Using Slashes and URL Encoding Combined to Bypass Validation Logic CAPEC-CAPEC-641 · DLL Side-Loading CAPEC-CAPEC-76 · Manipulating Web Input to File System Calls CAPEC-CAPEC-78 · Using Escaped Slashes in Alternate Encoding CAPEC-CAPEC-79 · Using Slashes in Alternate Encoding
⬡

Weakness Classification

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-706Use of Incorrectly-Resolved Name or Reference
▤

Related CVEs

8
CVEs linked to this one by a shared weakness (CWE) or affected product - joins on data already in the engine, with the reason shown per row. Not a guess.
CVE-2001-0054 Directory traversal vulnerability in FTP Serv-U before 2.5i allows remote attack... 1 same CWE-22 CVE-2001-0925 The default installation of Apache before 1.3.19 allows remote attackers to list... 4 same CWE-22 CVE-2001-0780 Directory traversal vulnerability in cosmicpro.cgi in Cosmicperl Directory Pro 2... 1 same CWE-22 CVE-2001-1432 Directory traversal vulnerability in Cherokee Web Server allows remote attackers... same CWE-22 CVE-2018-0237 A vulnerability in the file type detection mechanism of the Cisco Advanced Malwa... same CWE-706 MEDIUM CVE-2018-12020 mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decrypt... same CWE-706 HIGH CVE-2018-6112 Making URLs clickable and allowing them to be styled in DevTools in Google Chrom... same CWE-706 MEDIUM CVE-2019-0571 An elevation of privilege vulnerability exists when the Windows Data Sharing Ser... 1 same CWE-706 HIGH
🔗

References & Sources

1
Source URLs (vendor pages, mailing lists, write-ups). Exploit/PoC links are in their own section above to avoid duplication.
https://www.vulncheck.com/advisories/a10-networks-ax-loadbalancer-path-traversal
◈SOC and Response
◆Detection Engineering
◎Threat Hunting
▲Red Team and Pentest
■Compliance and GRC
◯About
threatengine.sh