A non-primary administrator user with admin rights to the web interface but without shell access permissions can display the configuration of the device, including the master admin password. This vulnerability also allows the user to grant themselves shell access with the root gid, posing a significant security risk.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.2 | CVE-2025-36729 |
Exploitation
To exploit this vulnerability, an attacker with non-primary administrator rights can access the web interface of the device. By leveraging their privileges, they can view sensitive configuration details, including the master admin password, and escalate their access to shell permissions.
Affected Products
- Web Interface: Allows non-primary administrators to view sensitive configurations.
- Device Configuration: Vulnerable to unauthorized access and privilege escalation.
Mitigation
To mitigate this vulnerability, it is recommended to restrict non-primary administrator users from accessing sensitive configurations and to review user permissions regularly. Additionally, implementing strong access controls and monitoring for unusual activities can help prevent exploitation.