CVE-2026-84481

EUVD-2026-69723
WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.php to obtain TLS private key file paths, socket configuration details, platform version, and debug flags enabling further targeted attacks.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.9 MEDIUM
NETWORK
LOW
NONE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 17.82%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
wwbnavideo
𝑥
≤ 30.0
CNA
Common Weakness Enumeration
References
https://github.com/WWBN/AVideo/security/advisories/GHSA-5jfh-mcm7-299m
https://www.vulncheck.com/advisories/wwbn-avideo-through-30.0-information-disclosure-via-mobilemanager
https://github.com/WWBN/AVideo/security/advisories/GHSA-5jfh-mcm7-299m