TFTP is not running in a restricted directory, allowing a remote attacker to access sensitive information such as password files.
CVSS Metrics
