CVE-2021-46417

What it actually does

The vulnerable Colibri Controller Module download functionality does not safely constrain requested file paths. A remote, unauthenticated attacker can submit path traversal sequences such as ../ or encoded equivalents to cause the controller to read files outside the intended download directory. Because the affected component handles the request with root privileges, the attacker may be able to retrieve sensitive operating system, application, configuration, or credential files from the device. The primary impact is high confidentiality loss; the published CVSS vector does not indicate direct integrity or availability impact.

Why it matters to the business

An exposed affected controller can leak sensitive operational and device information without requiring login. Disclosure of configuration files, credentials, keys, or system files can help an attacker understand fueling-site infrastructure, access additional services, or prepare follow-on attacks. The issue is not currently listed in CISA KEV and is not known to be used in ransomware campaigns, but exploit maturity is reported as weaponized and the EPSS score is elevated, making internet-exposed or partner-accessible devices a priority to assess and restrict.

How an attack unfolds

An attacker first identifies a Franklin Fueling Systems Colibri Controller running affected firmware, especially one with its web or management interface reachable over the network. The attacker then sends a crafted request to the download function using path traversal payloads, for example by replacing the expected filename with ../ sequences or URL-encoded variants. If vulnerable, the controller resolves the attacker-supplied path outside the intended directory and reads the target file as root. The file contents are returned in the HTTP response, allowing the attacker to collect system files, application configuration, credentials, logs, or environment details. The attacker can then use any exposed secrets or operational information to attempt lateral movement, credential reuse, or more targeted attacks against related systems.

How to fix it

Upgrade affected Franklin Fueling Systems Colibri firmware to a vendor-provided fixed release when available. No fixed version was provided in the input, so organizations should consult Franklin Fueling Systems advisories or support channels for the current corrected firmware and apply it following operational change-control procedures. Until a confirmed fix is installed, restrict access to the Colibri Controller web or management interface using network ACLs, firewalls, VPN-only access, and segmentation. Do not expose affected controllers directly to the internet. If configurable, disable or restrict the vulnerable download feature. Add reverse proxy or web application firewall rules to block path traversal patterns, including ../, URL-encoded traversal, and requests for sensitive system paths. After remediation, rotate any credentials, API keys, shared secrets, or certificates that may have been stored on or accessible from the controller if exploitation is suspected.

How to confirm the fix worked

Confirm the deployed firmware version and verify that affected version 1.8.19.8580 is no longer present. From an authorized test network, attempt a safe negative test against the download function using traversal sequences aimed at a non-sensitive known path; the controller should reject the request with 400/403/404 behavior and must not return file contents outside the intended download directory. Review firewall and exposure scans to confirm the management interface is not internet-accessible and is limited to approved administrative networks. Validate compensating controls by confirming traversal payloads are blocked or logged by the proxy, WAF, IDS, or firewall. If a vendor patch is applied, review release notes or vendor confirmation that the path traversal/download-file handling issue is addressed.

Typical attack path

1. Scan for exposed Franklin Fueling Systems Colibri Controller web or management interfaces.
2. Fingerprint the firmware or application behavior to identify potentially affected Colibri firmware, including version 1.8.19.8580.
3. Send crafted requests to the download function with path traversal sequences such as ../, ..%2f, or double-encoded variants.
4. Request sensitive files such as operating system account files, application configuration files, logs, or credential stores.
5. Review returned file contents for usernames, passwords, keys, internal addresses, or operational configuration.
6. Use disclosed information for follow-on access, credential reuse, reconnaissance, or targeted attacks against related infrastructure.

How to detect it

Look for historical evidence of crafted requests to the Colibri Controller download functionality that include directory traversal sequences or sensitive file paths. Useful sources include controller web access logs if available, reverse proxy logs, firewall logs, IDS/IPS alerts, VPN logs, packet captures, and network flow records for traffic to the controller management interface. Prioritize requests that returned HTTP 200, unusually large response sizes, or repeated probing of different file paths. Search for encoded and double-encoded traversal strings, requests for Unix/Linux system files, and suspicious filename parameters passed to download endpoints. Because the vulnerability is read-only at the CVSS level, direct host artifacts may be limited; also investigate any later authentication attempts, configuration access, or lateral movement that used credentials potentially exposed from the controller.

• ../
• ..%2f
• ..%2F
• %2e%2e%2f
• %2E%2E%2F
• %252e%252e%252f
• %c0%ae%c0%ae%c0%af
• /etc/passwd
• /etc/shadow
• /etc/hosts
• /etc/hostname
• /proc/self/environ
• /proc/version
• /root/.ssh/id_rsa
• /root/.ssh/authorized_keys
• download
• filename=../
• file=../
• path=../

What your security team should do

• Immediately inventory Franklin Fueling Systems Colibri Controller deployments and identify any running firmware version 1.8.19.8580 or unknown versions.
• Prioritize devices reachable from the internet, third-party networks, wireless networks, or broad internal networks because the flaw is remotely exploitable without authentication and has weaponized exploit maturity.
• Apply the vendor-provided fixed firmware when available; if no fixed firmware is available, open a vendor support case and document compensating controls.
• Restrict controller management access to approved administrative hosts or VPNs only; remove direct internet exposure.
• Deploy temporary detections and blocking rules for path traversal payloads targeting download functionality.
• Review historical HTTP, firewall, IDS, VPN, and proxy logs for traversal attempts and successful responses involving sensitive file paths.
• If exploitation is suspected, preserve logs and device images where feasible, rotate credentials stored on or used by the controller, and assess adjacent systems for credential reuse or follow-on activity.