ipTIME A2004 Access Control Vulnerability in hostinfo.cgi Allowing Unauthorized Information Disclosure

An access control vulnerability has been identified in the ipTIME A2004 router, specifically in version 12.17.0. The issue resides in the '/login/hostinfo.cgi' component, where attackers can access sensitive information, including version details, without authentication. This vulnerability could be exploited by simply visiting the affected URL.

Impact

Exploitation of this vulnerability allows for unauthorized access to sensitive information, such as device version details, which could be used for further attacks or exploitation.

Reproduction

To reproduce this vulnerability, navigate to the '/login/hostinfo.cgi' page on an ipTIME A2004 device running version 12.17.0. The version information will be displayed in the response headers, indicating successful exploitation.