CVE-2026-84481

Received Received - Intake

Information Disclosure in WWBN AVideo MobileManager Plugin

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: VulnCheck

Description

WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.php to obtain TLS private key file paths, socket configuration details, platform version, and debug flags enabling further targeted attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84481

EUVD

EUVD-2026-69723

Affected Vendors & Products

Vendor	Product	Version / Range
wwbn	avideo	to 30.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability is an information disclosure issue in WWBN AVideo version 30.0 or earlier. It allows unauthenticated attackers to access sensitive configuration data through the MobileManager plugin's getConfiguration endpoint. By sending a GET request to a specific URL, attackers can retrieve TLS private key file paths, socket settings, platform version, and debug flags without needing credentials.

Detection Guidance

To detect this vulnerability, check if unauthenticated GET requests to plugin/MobileManager/getConfiguration.json.php return sensitive configuration data. Use tools like curl to send a request: curl -X GET http://<target>/plugin/MobileManager/getConfiguration.json.php. If the response includes TLS private key paths, socket details, or debug flags, the system is vulnerable.

Impact Analysis

An attacker could exploit this to obtain sensitive server configuration details, including paths to private keys and debug settings. This information could enable further attacks, such as decrypting traffic, accessing protected resources, or gaining deeper access to the system. The impact depends on the server's configuration and exposure.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive data. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. Unauthorized access to configuration details may violate these regulations, potentially resulting in legal penalties or data breach notifications.

Mitigation Strategies

Immediately update WWBN AVideo to the latest version that patches this vulnerability. If an update is unavailable, restrict access to the MobileManager plugin endpoint via web server rules or firewall. Disable debug flags and review exposed configuration files for sensitive data leaks.

Hi! I’m here to help you understand CVE-2026-84481. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70