CVE-2026-84481 WWBN AVideo through 30.0 Information Disclosure via MobileManager
Unauthenticated attackers can access sensitive configuration data, including TLS key paths and debug flags, via the MobileManager plugin endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-84481?
CVE-2026-84481 is a medium-severity vulnerability in WWBN AVideo, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.php to obtain TLS private key file paths, socket configuration details, platform version, and debug flags enabling further targeted attacks.
Weakness: CWE-200
Which versions are affected by CVE-2026-84481?
How do I fix CVE-2026-84481?
No fix has been published for CVE-2026-84481 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-84481 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-84481 exists.
Sources
Also known as GHSA-hcv2-33x5-mf26.