PT-2025-38729 · 2Wcom · 2Wcom Ip-4C

Published 2025-09-22 · Updated 2025-10-14 · CVE-2025-57433

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions 2wcom IP-4c version 2.15.5

Description The web interface of the device contains a flaw that allows information disclosure. An authenticated attacker, even with limited privileges such as a guest account, can obtain hashed passwords for admin, manager, and guest accounts by submitting a specially crafted POST request to the /cwi/ajax request/get data.php API endpoint. This compromises the security of the system, as the retrieved hashes could be cracked to gain administrative access. The vulnerable parameter is not specified.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-57433

Affected Products

2Wcom Ip-4C

References · 6

• 🔥 https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-57433 · Exploit
• https://osv.dev/vulnerability/CVE-2025-57433 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57433 · Security Note
• https://2wcom.com · Note
• https://twitter.com/CVEnew/status/1970160922069959138 · Twitter Post
• https://t.me/cveNotify/138667 · Telegram Post