CVE-2026-84481: WWBN AVideo, изтичане на данни

Описание

Оригинално описание

WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.php to obtain TLS private key file paths, socket configuration details, platform version, and debug flags enabling further targeted attacks.

Засегнати продукти

• WWBN AVideo: до 30.0

Вид слабост

• CWE-200 Разкриване на чувствителна информация пред неоторизирана страна

История

Други уязвимости в WWBN AVideo

• 6.9CVE-2026-116800
• 5.4CVE-2026-116139
• 5.3CVE-2026-114634
• 7.0CVE-2026-114633
• 5.1CVE-2026-114048

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-84481
• https://nvd.nist.gov/vuln/detail/CVE-2026-84481
• https://github.com/WWBN/AVideo/security/advisories/GHSA-5jfh-mcm7-299m
• https://www.vulncheck.com/advisories/wwbn-avideo-through-30.0-information-disclosure-via-mobilemanager