WyreStorm Apollo VX20 up to 1.3.57 SoftAP GET Request /device/config missing encryption

Summaryinfo

A vulnerability was found in WyreStorm Apollo VX20 up to 1.3.57 and classified as problematic. Affected is an unknown function of the file /device/config of the component SoftAP GET Request Handler. Executing a manipulation can lead to missing encryption. This vulnerability is handled as CVE-2024-25735. The attack can be executed remotely. Additionally, an exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in WyreStorm Apollo VX20 up to 1.3.57. It has been declared as problematic. This vulnerability affects an unknown code of the file /device/config of the component SoftAP GET Request Handler. The manipulation with an unknown input leads to a missing encryption vulnerability. The CWE definition for the vulnerability is CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. As an impact it is known to affect confidentiality. CVE summarizes:

An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext passwords via a SoftAP /device/config GET request.

The advisory is shared for download at packetstormsecurity.com. This vulnerability was named CVE-2024-25735 since 02/11/2024. The attack can be initiated remotely. Technical details and also a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1600.

It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept.

Upgrading to version 1.3.58 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (51816). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• WyreStorm

Name

• Apollo VX20

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4
• 1.3.5
• 1.3.6
• 1.3.7
• 1.3.8
• 1.3.9
• 1.3.10
• 1.3.11
• 1.3.12
• 1.3.13
• 1.3.14
• 1.3.15
• 1.3.16
• 1.3.17
• 1.3.18
• 1.3.19
• 1.3.20
• 1.3.21
• 1.3.22
• 1.3.23
• 1.3.24
• 1.3.25
• 1.3.26
• 1.3.27
• 1.3.28
• 1.3.29
• 1.3.30
• 1.3.31
• 1.3.32
• 1.3.33
• 1.3.34
• 1.3.35
• 1.3.36
• 1.3.37
• 1.3.38
• 1.3.39
• 1.3.40
• 1.3.41
• 1.3.42
• 1.3.43
• 1.3.44
• 1.3.45
• 1.3.46
• 1.3.47
• 1.3.48
• 1.3.49
• 1.3.50
• 1.3.51
• 1.3.52
• 1.3.53
• 1.3.54
• 1.3.55
• 1.3.56
• 1.3.57

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion