Bridge Technologies VB288 Objective QoE Content Extractor Information Disclosure Vulnerability

A vulnerability allowing unauthorized access to sensitive information, such as administrator passwords, has been identified in the Bridge Technologies VB288 Objective QoE Content Extractor, specifically in firmware version 5.6.0-8. The issue arises from improper authorization in the '/probe/core/setup/passwd' endpoint, allowing attackers to extract password data through simple HTTP requests.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive information, specifically administrator passwords.

Reproduction

To reproduce this vulnerability, send a GET request to the '/probe/core/setup/passwd' endpoint. Include the 'Change' parameter set to '1', the 'passwd2' parameter with a value of 'slvisolp', and the 'submitflash' parameter set to 'OK'. This request will return the admin password.