CVE-2026-84481CWE-200information-disclosure

CVE-2026-84481

published September 2, 2026

CVSS
6.9
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.php to obtain TLS private key file paths, socket configuration details, platform version, and debug flags enabling further targeted attacks.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00445 · 37.6th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-09-02T03:17Z
References (3)
https://github.com/WWBN/AVideo/security/advisories/GHSA-5jfh-mcm7-299m · [email protected]https://www.vulncheck.com/advisories/wwbn-avideo-through-30.0-information-disclosure-via-mobilemanager · [email protected]https://github.com/WWBN/AVideo/security/advisories/GHSA-5jfh-mcm7-299m · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 01 SEP 22:25Z
    WWBN AVideo through 30.0 Information Disclosure via MobileManager
    cvelistv5