Vodacom Vodafone H500s up to 3.5.10 HTTP Endpoint /data/activation.json wifi_password information expsure

Summaryinfo

A vulnerability was found in Vodacom Vodafone H500s up to 3.5.10. It has been rated as problematic. This affects an unknown function of the file /data/activation.json of the component HTTP Endpoint. The manipulation of the argument wifi_password leads to information expsure. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is traded as CVE-2022-4985. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to apply restrictive firewalling.

Detailsinfo

A vulnerability was found in Vodacom Vodafone H500s up to 3.5.10. It has been rated as problematic. This issue affects an unknown function of the file /data/activation.json of the component HTTP Endpoint. The manipulation of the argument wifi_password with an unknown input leads to a information expsure vulnerability. Using CWE to declare the problem leads to CWE-497. The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does. Impacted is confidentiality. The summary by CVE is:

Vodafone H500s devices running firmware v3.5.10 (hardware model Sercomm VFH500) expose the WiFi access point password via an unauthenticated HTTP endpoint. By sending a crafted GET request to /data/activation.json with specific headers and cookies, a remote attacker can retrieve a JSON document that contains the wifi_password field. This allows an unauthenticated attacker to obtain the WiFi credentials and gain unauthorized access to the wireless network, compromising confidentiality of network traffic and attached systems.

The weakness was shared by Daniel Monzón as 50636. The advisory is shared at exploit-db.com. The identification of this vulnerability is CVE-2022-4985 since 11/14/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known. MITRE ATT&CK project uses the attack technique T1592 for this issue.

The exploit is available at exploit-db.com. It is declared as proof-of-concept. By approaching the search of inurl:data/activation.json it is possible to find vulnerable targets with Google Hacking.

Addressing this vulnerability is possible by firewalling .

The vulnerability is also documented in the databases at Exploit-DB (50636) and EUVD (EUVD-2022-55681). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Vodacom

Name

• Vodafone H500s

Version

• 3.5.0
• 3.5.1
• 3.5.2
• 3.5.3
• 3.5.4
• 3.5.5
• 3.5.6
• 3.5.7
• 3.5.8
• 3.5.9
• 3.5.10

Support

• end of life

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion