CVE-2023-36654: Prolion Cryptospike

Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days.

Directory traversal in the log-download REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to download host server SSH private keys (associated with a Linux root user) by injecting paths inside REST API endpoint parameters.

Affected products

• Prolion Cryptospike: version 3.0.15 only

Published 2023-12-12. Last modified 2026-06-17.