Executive brief
Gigamon GigaVUE-OS (GVOS) appliances, which are used to manage and monitor network traffic, contain a security flaw in their management interface. An unauthenticated attacker can exploit this to remotely read sensitive system files or perform limited file modifications. This could lead to a full compromise of the device, potentially allowing an attacker to intercept network data or gain a foothold in the corporate network.
Technical details
A path traversal vulnerability (CWE-22) exists in the TornadoHTTP-based management engine on port 8089 of Gigamon GVOS appliances. The flaw is located within the legacy H-VUE subsystem's 'persistd' daemon, specifically in the 'DownloadDbFile' and 'UploadDbFile' handlers in 'persistd.py'. These handlers fail to sanitize user-supplied path inputs before passing them to file system operations. An unauthenticated remote attacker can use traversal sequences (e.g., '../') to escape the intended directory. This enables arbitrary file read and partial file write (creation of new files via .tmp rename) with root privileges. While the NVD entry lists severity as 'info', the technical impact of unauthenticated remote root access constitutes a critical risk.
Affected products
- Gigamon GigaVUE-OS (GVOS) v5.16.1 and below
Timeline
- 2026-06-29: disclosed: Initial CVE publication and NVD entry
- 2026-06-29: other: Public exploit code released on GitHub