CVE-2024-6445 is a high severity (CVSS 7.5) path traversal flaw in DataFlowX Technology DataDiodeX. It affects versions from 3.0.0 up to but not including 3.1.7. The fix is to move to 3.1.7 or any later release.
What's affected
The record states the scope plainly: DataDiodeX from v3.0.0 before v3.1.7. So 3.1.7 is the first version outside the range. Anything older than 3.0.0 is not listed as affected, and the record does not say whether those older builds were reviewed.
The weakness is CWE-22, improper limitation of a pathname to a restricted directory. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. In plain words: reachable over the network, easy, no login, and the damage is to confidentiality only.
The record cites two Turkish national bulletins, both numbered TR-24-1409: one from the national cyber security authority and one from USOM. Neither page loaded when this post was prepared, so the details above come from the NVD record. Check the bulletin text for any extra mitigation steps.
KEV status is false. No source I could use says the flaw is being exploited.
How to check if you're exposed
- Find DataDiodeX on your network. It is a data transfer product, so ask the teams that run one way transfers between network zones.
- Read the installed version from the product's own version screen or package metadata and compare it with 3.0.0 to 3.1.7.
- If you cannot tell the version, treat it as exposed until the vendor confirms it.
- Check logs on the web or service front end for requests containing sequences like
../or encoded forms of it. Those are the sign of someone probing a traversal weakness.
What to do now
- Upgrade to 3.1.7 or later from DataFlowX. Test in a staging copy first if the device sits between sensitive zones.
- Until the upgrade is done, limit who can reach the service to the systems that need it.
- Run the service under an account that can read only its own data directory, so a traversal bug has little to find.
- Review which files the service account could read. If it had access to configuration or key files, rotate those secrets after patching.
- Search logs for traversal patterns going back to the date you installed 3.0.0 or later.
Why it matters
Path traversal lets a caller step out of the folder an application meant to serve and read files elsewhere on the host. For a product whose job is to move data between zones with strong separation, a file read flaw weakens the point of the product.
The root cause is input that names a file, combined with a path check that does not hold. Safe code resolves the final path and confirms it still sits inside the allowed directory, or avoids user supplied path parts altogether.
Quick check
Which version fixes it?
Version 3.1.7. The record says the issue affects 3.0.0 before 3.1.7, so 3.1.7 and later are outside the range.
Does it change data or only read it?
The vector scores impact on confidentiality only, with none on integrity or availability. Confirm in the Turkish bulletin if you need the vendor's wording.
Sources
- NVD record for CVE-2024-6445
- USOM bulletin TR-24-1409 and national cyber security bulletin (not retrievable when this post was prepared)
Last reviewed: 19 October 2026.
