Directory traversal vulnerability in the WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to read arbitrary files via a crafted pathname.
https://ics-cert.us-cert.gov/advisories/ICSA-16-159-01
https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-5519