CVE-2025-57430
BaseFortify
Publication date: 2025-09-22
Last updated on: 2025-10-14
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| creacast | creabox_manager | 4.4.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Creacast Creabox Manager 4.4.4 allows anyone to access a publicly available endpoint (/get) that exposes sensitive internal configuration data. Specifically, it returns the creacodec.lua file, which contains plaintext administrator credentials, potentially allowing unauthorized access.
How can this vulnerability impact me? :
The exposure of plaintext admin credentials through a public endpoint can lead to unauthorized access to the system, allowing attackers to control or manipulate the device or software, potentially leading to data breaches, service disruption, or further exploitation.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if the /get endpoint on your Creacast Creabox Manager 4.4.4 instance is publicly accessible and returns sensitive configuration data. For example, you can use a command like: curl http://<target-ip-or-hostname>/get to see if the internal configuration, including creacodec.lua with plaintext admin credentials, is exposed.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the /get endpoint to authorized users only, disabling or removing the endpoint if not needed, and changing any exposed plaintext admin credentials found in the creacodec.lua file. Additionally, monitor access logs for unauthorized requests to this endpoint.