CVE-2021-23858CWE-200

Information disclosure

High · published October 4, 2021

CVSS v3.1
8.6
EPSS
1%
Percentile
69.0
In the wild
Unconfirmed
What it is

Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another unprotected web server resource.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01243 · 69.0th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2021-10-04T17:32Z
EPSS history
Timeline
  • 04 OCT 17:32Z
    Information disclosure
    cvelistv5