FOG Project EUVD-2026-101520

Exploitation requires that the FOG management web interface is network-reachable and that an operator has configured a default Active Directory domain-join credential (FOG_AD_DEFAULT_PASSWORD); the adInfo() endpoint could then be invoked unauthenticated by dispatching through node=ipxe, returning that credential in the domainpass JSON field. No user interaction or authenticated session is needed (PR:N/UI:N). The key limiting factor is configuration state: if no default AD password is set the endpoint discloses no sensitive value, so impact is confined to deployments that use FOG's automatic AD domain-join feature and have not upgraded to 1.5.10.1870.

All signals point to a genuine but context-dependent information-disclosure issue rather than a high-impact critical flaw. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) describes a remote, low-complexity, unauthenticated read with high confidentiality impact and no integrity or availability impact, which is internally consistent with the CWE-200 classification and the description of an unauthenticated endpoint leaking a credential. No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so exploitation probability and automatability cannot be quantified from the input; this is no public exploit identified at time of analysis. The vendor fix is confirmed via GitHub release 1.5.10.1870 and three commits that remove the 'ipxe' dispatch path, so the vulnerability and remediation are well-corroborated by source evidence. Practical severity hinges on whether an operator actually configured FOG_AD_DEFAULT_PASSWORD - if that value is unset or empty the endpoint discloses nothing sensitive, which likely tempers real-world impact below what the raw 7.5 implies. Net: a real priority for FOG operators that set a default AD domain-join credential and expose the management interface, but lower urgency where AD auto-join is unused or the interface is network-segmented.

A remote, unauthenticated attacker who can reach the FOG management web interface requests the adInfo() endpoint dispatched through node=ipxe and reads the domainpass field from the returned JSON, recovering the configured default Active Directory domain-join password. With a valid domain-join credential the attacker can then pivot toward the organization's AD environment. No public exploit code is identified, but the trivially-scriptable unauthenticated request and published fix commits make reproduction straightforward.