| शीर्षक | ZLT M30s MTNNGRM30S_1.47, M30S_1.47 (other versions might be vulnerable) Improper Access Control - Critical Information Disclosure |
|---|
| विवरण | The /reqproc/proc_post endpoint of the web management interface can be accessed without authentication and returns sensitive device information through isTest parameter set to false and goformId parameter set to export_information. This includes configuration data that exposes administrative account credentials in plaintext. As a result, an attacker can retrieve information sufficient to gain full access to the device’s web management interface. |
|---|
| स्रोत | ⚠️ https://www.hacklab.eu.org/blogs/zlt_m30s_information_disclosure |
|---|
| उपयोगकर्ता | S33K3R (UID 92688) |
|---|
| सबमिशन | 05/12/2025 04:45 PM (11 महीनों पहले) |
|---|
| संयम | 25/12/2025 10:36 AM (20 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 338410 [TOZED ZLT M30s तक 1.47 Web Management Interface /reqproc/proc_post goformId सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|