CVE-2021-44124: Hiby r3 Pro Firmware

High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days.

Hiby Music Hiby OS R3 Pro 1.5 and 1.6 is vulnerable to Directory Traversal. The HTTP Server does not have enough input data sanitization when shown data from SD Card, an attacker can navigate through the device's File System over HTTP.

Affected products

• Hiby r3 Pro Firmware: version 1.5 only; version 1.6 only

Published 2022-03-28. Last modified 2026-06-17.