Information disclosure in 2wcom Ip-4c
CVE-2025-57433
The 2wcom IP-4c 2.15.5 device's web interface includes an information disclosure vulnerability. By sending a crafted POST request to a specific endpoint (/cwi/ajax_request/get_data.php), an authenticated attacker (even with a low-privileged account like guest) can retrieve the hashed passwords for the admin, manager, and guest accounts. This significantly weakens the system's security posture, as these hashes could be cracked offline, granting attackers administrative access to the device.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (27.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 28th percentile — 27.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- 2wcom Ip-4c
- 2wcom Ip-4c Firmware — versions 2.15.5
Weakness classification (CWE)
References
- www.2wcom.com/ (Product)
- github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-57433 (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-57433?
- CVE-2025-57433 is a medium-severity vulnerability in 2wcom Ip-4c, classified under Information Disclosure. CVSS score: 6.5/10. Published 2025-09-22.
- How severe is CVE-2025-57433?
- Medium severity. CVSS v3 base score is 6.5 out of 10.