CVE-2023-37607: High Path Traversal in FL9600 FirstLane

CVE-2023-37607 is a high severity (CVSS 7.5) directory traversal flaw in the Automatic Systems SOC FL9600 FirstLane, version V06, a lane control system. A remote attacker can read sensitive files without logging in. The record names no fixed version, so restrict network access and ask the vendor about a patch.

What's affected

The record names the Automatic Systems SOC FL9600 FirstLane firmware version 06 (build lego_T04E00) and the matching hardware. It scores the flaw 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N: network attack, no privileges, no user interaction, with a high confidentiality impact and no effect on integrity or availability.

According to the record, the problem is in the csvServer.php file, where a file parameter combined with a double dot sequence in the dir parameter lets a remote attacker obtain sensitive information. The weakness is CWE-22 (path traversal).

The record does not give a fixed version. The only references are a write up on GitHub from CQURE and the vendor's product range page, neither of which, as far as we could confirm, publishes a patch. The record does not flag CISA KEV, and nothing we read says the flaw is exploited in the wild.

How to check if you're exposed

There is no package manager story for a lane controller. Ask your integrator or the vendor for the exact firmware and build on each unit and compare it with V06 and lego_T04E00.

Then look at exposure. The unit should not be reachable from the internet or from general office networks. Check firewall rules, and check whether any remote support path or port forward reaches the web interface.

If you have web server or proxy logs for the device, look for requests to csvServer.php from addresses that are not your own management hosts.

What to do now

1. List every FirstLane unit, with firmware and build, and who administers it.
2. Contact Automatic Systems or your integrator, ask whether a fixed firmware exists for V06, and record the answer.
3. Move the units onto an isolated management network and block access from the internet and from user networks.
4. Put a reverse proxy or firewall in front of the web interface that only allows named management hosts.
5. Review logs on adjacent systems for unexpected access to the device, and rotate any credentials that could be read from files on it.

Why it matters

Path traversal means the application builds a file path from input and fails to keep it inside the intended folder. By supplying parent directory references, a caller can step out of that folder and ask for other files. The attacker gets read access to whatever the web server account can read, which on embedded systems often includes configuration and credentials.

Operational technology like toll and access lanes tends to run old firmware for years, and a patch can require a visit from the vendor. That makes network segmentation the main control. The same product has a second record, CVE-2023-37608, for a hardcoded credential, and together they make exposure to any untrusted network a poor idea.

Quick check

Sources

• CQURE write up for CVE-2023-37607
• Vendor product range page (linked from the record; no advisory or fix was found there that we could confirm)
• CVE-2023-37607 on Gold

Last reviewed: 19 October 2026.