SecuSTATION Camera V2.5.5.3116-S50-SMA-B20160811A and lower allows an unauthenticated attacker to download device configuration files via a crafted request.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')