{"id":"CVE-2026-125659","kind":"vulnerability","aliases":["CVE-2026-125659"],"related":[],"title":"eMudhra emBridge: unauthenticated file and directory name enumeration over local API","description":"This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpoints. These endpoints perform file system enumeration using the LocalSystem account without adequately validating the requesting caller's authorization. An unauthenticated attacker on the same LAN could exploit this vulnerability by sending malicious webpage to the local HTTPS Web API.\n\n \n\nSuccessful exploitation of this vulnerability could allow the attacker to enumerate file and directory names and obtain information about the directory structure of the targeted system. \n\n\n\nThe vulnerability however, does not provide access to file contents or permit file modification, deletion, or code execution, or access to cryptographic keys and hardware token PINs.","summary":"The eMudhra emBridge local HTTPS API has FileBrowser endpoints that list file and directory names on the machine without checking who is asking. An attacker on the same LAN can use a malicious webpage to learn the directory structure, but cannot read file contents, modify files, or run code.","severity":"low","cvss":2.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["emudhra-embridge","other","windows"],"not_affected_if":["embridge-not-installed"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T11:17:16+00:00","first_seen_at":"2026-11-13T11:44:17+00:00","triaged_at":"2026-11-13T11:44:30+00:00","updated_at":"2026-11-13T11:44:30+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T11:44:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"eMudhra emBridge: unauthenticated file and directory name enumeration over local API","impact":"low","summary":"The eMudhra emBridge local HTTPS API has FileBrowser endpoints that list file and directory names on the machine without checking who is asking. An attacker on the same LAN can use a malicious webpage to learn the directory structure, but cannot read file contents, modify files, or run code.","audience":"businesses","category":"other","nicknames":[],"who_cares":["emudhra-embridge","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker lists file and directory names on the system","analyst_note":"Find the affected and fixed emBridge versions and the vendor advisory; the NVD entry gives none.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["embridge-not-installed"],"who_is_affected":"Systems where the eMudhra emBridge application is installed and its local HTTPS Web API is reachable from the network, which is the path a malicious webpage uses. Machines without emBridge installed are not exposed. The sources do not state the affected versions or a fixed release.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.0007,"input_tokens":4690,"output_tokens":462,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-125659':14A,17A '-2026':13A,16A 'access':160C,173C 'account':98C 'adequ':100C 'allow':134C 'api':11A,28B,87C,127C 'ask':45B 'attack':47B,109C,136C 'author':82C,106C 'caller':104C 'cannot':63B 'check':42B,83C 'code':71B,170C 'content':66B,163C 'could':114C,133C 'cryptograph':175C 'cve':12A,15A 'delet':168C 'directori':6A,36B,60B,141C,148C 'due':79C 'embridg':2A,20B,25B,78C 'emudhra':1A,19B,24B,77C 'emudhra-embridg':18B 'endpoint':31B,88C,90C 'enumer':8A,94C,138C 'execut':171C 'exist':74C 'exploit':115C,129C 'file':4A,34B,65B,68B,92C,139C,162C,166C 'filebrows':30B,86C 'hardwar':178C 'howev':156C 'https':27B,125C 'inform':145C 'key':176C 'lan':51B,113C 'learn':58B 'list':33B 'local':10A,26B,124C 'localsystem':97C 'machin':40B 'malici':55B,120C 'miss':81C 'modif':167C 'modifi':67B 'name':7A,37B,142C 'obtain':144C 'perform':91C 'permit':165C 'pin':180C 'provid':159C 'read':64B 'request':103C 'run':70B 'send':119C 'structur':61B,149C 'success':128C 'system':93C,153C 'target':152C 'token':179C 'unauthent':3A,108C 'use':53B,95C 'valid':101C 'vulner':73C,117C,132C,155C 'web':126C 'webpag':56B,121C 'window':22B 'without':41B,99C","nicknames":[],"mitigations":[],"who_affected":"Systems where the eMudhra emBridge application is installed and its local HTTPS Web API is reachable from the network, which is the path a malicious webpage uses. Machines without emBridge installed are not exposed. The sources do not state the affected versions or a fixed release.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["emudhraembridge","low","other","windows"],"campaign_type":null,"search_a":"'-125659':14A,17A '-2026':13A,16A 'api':11A 'cve':12A,15A 'directori':6A 'embridg':2A 'emudhra':1A 'enumer':8A 'file':4A 'local':10A 'name':7A 'unauthent':3A","search_b":"'api':28B 'ask':45B 'attack':47B 'cannot':63B 'check':42B 'code':71B 'content':66B 'directori':36B,60B 'embridg':20B,25B 'emudhra':19B,24B 'emudhra-embridg':18B 'endpoint':31B 'file':34B,65B,68B 'filebrows':30B 'https':27B 'lan':51B 'learn':58B 'list':33B 'local':26B 'machin':40B 'malici':55B 'modifi':67B 'name':37B 'read':64B 'run':70B 'structur':61B 'use':53B 'webpag':56B 'window':22B 'without':41B","search_c":"'access':160C,173C 'account':98C 'adequ':100C 'allow':134C 'api':87C,127C 'attack':109C,136C 'author':82C,106C 'caller':104C 'check':83C 'code':170C 'content':163C 'could':114C,133C 'cryptograph':175C 'delet':168C 'directori':141C,148C 'due':79C 'embridg':78C 'emudhra':77C 'endpoint':88C,90C 'enumer':94C,138C 'execut':171C 'exist':74C 'exploit':115C,129C 'file':92C,139C,162C,166C 'filebrows':86C 'hardwar':178C 'howev':156C 'https':125C 'inform':145C 'key':176C 'lan':113C 'local':124C 'localsystem':97C 'malici':120C 'miss':81C 'modif':167C 'name':142C 'obtain':144C 'perform':91C 'permit':165C 'pin':180C 'provid':159C 'request':103C 'send':119C 'structur':149C 'success':128C 'system':93C,153C 'target':152C 'token':179C 'unauthent':108C 'use':95C 'valid':101C 'vulner':73C,117C,132C,155C 'web':126C 'webpag':121C 'without':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T11:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vdisclose@cert-in.org.in","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125659","severity":null,"published_at":"2026-11-13T11:17:16+00:00","modified_at":"2026-11-13T11:17:16+00:00","first_seen_at":"2026-11-13T11:44:17+00:00","fetched_at":"2026-11-13T11:44:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}