Description
QiHang Media Web Digital Signage 3.0.9 contains a cleartext credentials vulnerability that allows unauthenticated attackers to access administrative login information through an unprotected XML file. Attackers can retrieve hardcoded admin credentials by requesting the '/xml/User/User.xml' file, enabling direct authentication bypass.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Shenzhen Xingmeng Qihang Media Co., Ltd.Guangzhou Hefeng Automation Technology | QiHang Media Web Digital Signage | 3.0.9 | — |
References
- ExploitDB-48748 exploit
- Official Product Homepage product
- Vendor Security Advisory for ZSL-2020-5579 vendor-advisory vdb-entry
- VulnCheck Advisory: QiHang Media Web Digital Signage 3.0.9 Cleartext Credentials Disclosure third-party-advisory