| शीर्षक | Gigatech R&D Corporation PDV5701 Config Web Management Firmware for PDV5701 DoorStation SwVersion 1.0.31_240305_112640，HW Version 004.002.001 Missing Authentication |
|---|
| विवरण | Gigatech PDV5701 Config Web Management Firmware SwVersion 1.0.31_240305_112640 has a missing authentication vulnerability in its WebSocket management interface.
An unauthenticated attacker can access http://<device-ip>:81/index.html and connect to ws://<device-ip>:81/getparameter without any cookie, token, or login session. The device returns Webmode:"0" together with sensitive administrator credential fields, including ACCUSER and ACCPASSWD.
The leaked credentials are valid. Sending a setlogin WebSocket message with the leaked account and password returns {"action":"CheckLogin","data":"success"}, allowing administrative access to the web management interface.
Other unauthenticated WebSocket endpoints, such as /getconfig and /getaccount, also expose device configuration and account records. The WebSocket service does not properly validate the Origin header.
Successful exploitation may lead to administrator credential disclosure, sensitive data leakage, and management interface takeover.
Affected version verified: SwVersion 1.0.31_240305_112640, HW Version 004.002.001. |
|---|
| स्रोत | ⚠️ https://github.com/CSDVi/cve/issues/2 |
|---|
| उपयोगकर्ता | david_12 (UID 99465) |
|---|
| सबमिशन | 19/07/2026 12:38 PM (2 महीनों पहले) |
|---|
| संयम | 21/09/2026 07:48 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 408193 [Gigatech PDV5701 1.0.31_240305_112640 WebSocket Service /index.html कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|