Shenzhen Zhibotong Electronics ZBT WE2001 Unauthenticated Credential Disclosure Vulnerability

A vulnerability in the web API of the Shenzhen Zhibotong Electronics ZBT WE2001 router, specifically in version 23.09.27, allows remote unauthenticated attackers to access administrative information-retrieval functions meant for authenticated users. This lack of session validation enables attackers to invoke 'get_*' operations and obtain device configuration data, including plaintext credentials, without the need for authentication or an active session.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive device configuration data, including plaintext credentials.