CVE-2024-33470

The AVTECH Room Alert 4E v4.4.0 environmental monitoring device is vulnerable to a passback attack within its SMTP Email Settings . When an administrator authenticates and browses settings pages, the SMTP password is loaded and displayed in the DOM in plaintext . Additionally, credentials are sen...

PT-2024-25276 · Avtech · Avtech Room Alert 4E

Name of the Vulnerable Software and Affected Versions: AVTECH Room Alert 4E version 4.4.0 Description: An issue in the Sensor Settings allows attackers to gain access to SMTP credentials in plaintext via a crafted AJAX request to an unspecified API endpoint. This issue only affects products that...