| 标题 | ZLT M30s MTNNGRM30S_1.47, M30S_1.47 (other versions might be vulnerable) Improper Access Control - Critical Information Disclosure |
|---|
| 描述 | The /reqproc/proc_post endpoint of the web management interface can be accessed without authentication and returns sensitive device information through isTest parameter set to false and goformId parameter set to export_information. This includes configuration data that exposes administrative account credentials in plaintext. As a result, an attacker can retrieve information sufficient to gain full access to the device’s web management interface. |
|---|
| 来源 | ⚠️ https://www.hacklab.eu.org/blogs/zlt_m30s_information_disclosure |
|---|
| 用户 | S33K3R (UID 92688) |
|---|
| 提交 | 2025-12-05 16時45分 (11 月前) |
|---|
| 管理 | 2025-12-25 10時36分 (20 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 338410 [TOZED ZLT M30s 直到 1.47 Web Management Interface /reqproc/proc_post goformId 信息公开] |
|---|
| 积分 | 20 |
|---|