Executive Summary

This vulnerability exists in the 2wcom IP-4c 2.15.5 device's web interface, where an authenticated attacker, even with a low-privileged account like guest, can send a specially crafted POST request to a specific endpoint (/cwi/ajax_request/get_data.php) to retrieve hashed passwords for admin, manager, and guest accounts. This allows the attacker to potentially crack these hashes offline and gain administrative access to the device.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can significantly weaken the security of the affected device by allowing attackers to obtain hashed passwords of critical accounts. If these hashes are cracked, attackers can gain administrative access, potentially leading to unauthorized control, data theft, or disruption of device operations.

Useful 0 Not Useful 0