Description
TG8 Firewall exposes a directory such as /data/ over HTTP without authentication. This directory stores credential files for previously logged-in users. A remote unauthenticated attacker can enumerate and download files within the directory to obtain valid account usernames and passwords, leading to loss of confidentiality and further unauthorized access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TG8 | TG8 Firewall | — | — |
References
- https://ssd-disclosure.com/ssd-advisory-tg8-firewall-preauth-rce-and-password-disclosure/ technical-description exploit
- https://web.archive.org/web/20211024224240/http://www.tg8security.com/ product
- https://www.vulncheck.com/advisories/tg8-firewall-unauthenticated-user-password-disclosure third-party-advisory