Ericsson-LG iPECS NMS 30M allows directory traversal via ipecs-cm/download?filename=../ URIs.
ericssonlg ipecs nms 30m-2.3gn
ericssonlg ipecs nms 30m-b.2ia