Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file download process of the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploited, the product's files may be obtained and/or altered by a crafted HTTP request to specific functions of the product from a device connected to the LAN side.

Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file download process of the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploited, the product's files may be obtained and/or altered by a crafted HTTP request to specific functions of the product from a device connected to the LAN side.

Home gateway HGW-BL1500HM provided by KDDI CORPORATION contains multiple vulnerabilities listed below. <ul><li>Stored cross-site scripting in the NickName registration screen (CWE-79) - CVE-2025-27567</li><li>Stored cross-site scripting in the USB storage file-sharing function (CWE-79) - CVE-2025-27574</li><li>Path traversal in the file/folder listing process of the USB storage file-sharing function (CWE-22) - CVE-2025-27716</li><li>Path traversal in the file upload process of the USB storage file-sharing function (CWE-22) - CVE-2025-27718</li><li>Path traversal in the file download process of the USB storage file-sharing function (CWE-22) - CVE-2025-27726</li><li>Path traversal in the file deletion process of the USB storage file-sharing function (CWE-22) - CVE-2025-27932</li></ul> Huiseong Seo reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.