Information disclosure in 2wcom Ip-4c
CVE-2025-57433
The 2wcom IP-4c 2.15.5 device's web interface includes an information disclosure vulnerability. By sending a crafted POST request to a specific endpoint (/cwi/ajax_request/get_data.php), an authenticated attacker (even with a low-privileged account like guest) can retrieve the hashed passwords for the admin, manager, and guest accounts. This significantly weakens the system's security posture, as these hashes could be cracked offline, granting attackers administrative access to the device.
Vulnerability class: Information Disclosure
EPSS: 0.003 (26.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- 2wcom Ip-4c
- 2wcom Ip-4c_firmware — versions 2.15.5
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Product)
- cve@mitre.org (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-57433?
- CVE-2025-57433 is a medium-severity vulnerability in 2wcom Ip-4c, classified under Information Disclosure. CVSS score: 6.5/10. Published 2025-09-22.
- How severe is CVE-2025-57433?
- Medium severity. CVSS v3 base score is 6.5 out of 10.