Akinsoft Wolvox Control Panel
Monthly
Unauthenticated information disclosure in the AKINSOFT WOLVOX Control Panel (versions 26.02.25 up to but not including 26.02.26) lets a remote attacker reach the panel over the network and pull sensitive data from system resources into responses sent back to the client. Because the assessed attack vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed against an internet- or network-reachable instance, and successful exploitation yields high confidentiality impact (C:H), exposing host/system-level information to an unauthorized party. Note that the supplied base vector (9.8) also asserts high integrity and availability impact, whereas the independent assessment scopes the issue to confidentiality only (I:N/A:N); either way the practical effect is data exposure rather than code execution or service disruption. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fix.
Unauthenticated information disclosure in the AKINSOFT WOLVOX Control Panel (versions 26.02.25 up to but not including 26.02.26) lets a remote attacker reach the panel over the network and pull sensitive data from system resources into responses sent back to the client. Because the assessed attack vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed against an internet- or network-reachable instance, and successful exploitation yields high confidentiality impact (C:H), exposing host/system-level information to an unauthorized party. Note that the supplied base vector (9.8) also asserts high integrity and availability impact, whereas the independent assessment scopes the issue to confidentiality only (I:N/A:N); either way the practical effect is data exposure rather than code execution or service disruption. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fix.